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FOREWORD 
by the Director General 


The IAEA initiated in 1990 a programme to assist the countries of eastern Europe and the 
former Soviet Union in evaluating the safety of their first generation WWER-440/230 nuclear power 
plants. The main objectives of the Programme were: to identify major design and operational safety 
issues; to establish international consensus on priorities for safety improvements; and to provide 
assistance in their implementation. 


The scope of the Programme was extended in 1992 to include RBMK and WWER-1000 plants 
in operation and under construction. The Programme complements ongoing IAEA activities on 
WWER-440/213 plants. 


The Programnme is pursued by means of plant specific safety review missions to assess the 
adequacy of design and operational practices; Assessment of Safety Significant Events Team (ASSET) 
reviews of operational performance; reviews of plant design, including seismic safety studies; and 
topical meetings on generic safety issues. Other components are: follow-up safety missions to nuclear 
plants to check the status of implementation of IAEA recommendations; assessments of all safety 
improvements implemented or proposed; peer reviews of safety studies; and training workshops. The 
IAEA is also maintaining a database on the technical safety issues identified for each plant and the 
status of implementation of safety improvements. An additional important element is the provision 
of assistance by the IAEA to strengthen regulatory authorities. 


The Programme is extrabudgetary and depends on voluntary contributions from IAEA Member 
States. Steering Committees provide co-ordination and guidance to the IAEA on technical matters and 
serve as forums for exchange of information with the CEC and with other international and financial 
organizations. 


The Programme, which takes into account the results of other relevant national, bilateral and 
multilateral activities, will provide a technical basis for safety related decisions to be made by the 
countries operating WWER and RBMK plants and by countries providing technical and financial 
support for upgrading the safety of nuclear power plants in these countries. 


The IAEA further provides technical advice in the co-ordination structure established by the 
Group of 24 OECD countries through the Commission of the European Council to provide technical 
assistance on nuclear safety matters to the countries of eastern Europe and the former Soviet Union. 


PREFACE 


Since the accident at Chernobyl Unit 4 in 1986, RBMK specialists have identified a number 
of modifications made to enhance the safety of RBMK reactors. Some of these modifications have 
already been made, while others are still in the implementation or planning stages. As a result of 
work which was started in 1986, other potential modifications have been identified for further 
consideration. 


The purpose of this report is to summarize the findings and recommendations of a Consultants 
Meeting convened by the ТАЕА in Vienna (27 October - 5 November 1992) to review new design 
features and modifications proposed or already implemented for RBMK reactors. This information 
was provided in four technical areas, namely: Core Monitoring and Control, Pressure Boundary 
Integrity, Accident Mitigation and Electric Power Supply. 


The report also presents the status of the modifications at the plants as given by the RBMK 
specialists. 


The limited information available and the time constraints did not allow the review to be 
conducted at the level of a peer review, and the findings and recommendations made reflect the limited 
scope of the review. More detailed reviews and analyses focusing on selected safety issues are 
required and should be conducted on a generic and plant specific basis as appropriate. 


In Chapters 2-5 of the report the main findings and recommendations for the four topical areas 
reviewed are summarized. Appendices I-IV reflect the results of the discussions held at the meeting 
and provide more detailed information on the review. 


EDITORIAL NOTE 


In preparing this material for the press, staff of the International Atomic Energy Agency have 
mounted апа paginated the original manuscripts and given some attention to presentation. 

The views expressed do not necessarily reflect those of the governments of the Member States or 
organizations under whose auspices the manuscripts were produced. 

The use in this book of particular designations of countries or territories does not imply any 
judgement by the publisher, the IAEA, as to the legal status of such countries or territories, of their 
authorities and institutions or of the delimitation of their boundaries. 

The mention of specific companies or of their products or brand names does not imply any 
endorsement or recommendation on the part of the IAEA. 
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1. INTRODUCTION 


Following the Technical Committee Meeting convened by the IAEA in April 1992, the IAEA 
announced, in June 1992, an Extrabudgetary Programme on the Safety of RBMK Nuclear Power 
Plants and invited its Member States to assist in its implementation. Along the lines recommended 
by the Technical Committee a work plan has been developed for the programme implementation which 
is focusing on: 


- assisting in the definition of scope and priorities for technical work required; 

- organizing specialists meetings on topical areas of RBMK safety; 

- conducting plant specific safety missions to relevant plant sites to review specific 
topics related to design and to the conduct of operation; 

- serving as a forum to establish international consensus on safety improvements 
required; 

- peer review results; 

- providing training. 


In addition to the improvements in areas important to safety which are to be implemented 
immediately a most important task is a comprehensive safety review of RBMKs. 


As а first step in the programme implementation, a Consultants Meeting to assess the safety 
improvements already proposed was organized by the IAEA in Vienna from 27 October - 5 November 
1992 on the Safety Assessment of Proposed Improvements of RBMK NPPs. 


The objective of the meeting was to review the scope and results of safety evaluations 
performed and the technical basis for the safety improvements implemented and planned for the 
RBMK reactors. Areas where further work is needed were specified and shortcomings of work 
performed or planned were identified. The results of this meeting will contribute to establishing a 
basis for further activities and decisions on technical and financial support for implementation of 
measures to improve safety. 


Based on the papers presented during the Technical Committee Meeting on Safety of RBMK 
Reactors, and the discussions during that meeting, four technical areas were selected for review: 


- Core Monitoring and Control; 
- Pressure Boundary Integrity; 
- Accident Mitigation; 

- Electric Power Supply. 


In order to facilitate the review, supporting documentation was prepared by RBMK specialists, 
in English, in each of the above areas of review [1-17]. In addition, further background information 
was provided by the RBMK specialists participating in the meeting. 


The information available for review included, in general, design objectives and concept, 
system description, including system operation and interaction, safety concerns already identified by 
designers/operators, proposed safety improvements, including applicability and status of 
implementation to each individual RBMK unit and information on differences/modifications of the 
existing three generations of RBMKs and on plant specific status. 


A commonly accepted strategy for the evaluation of nuclear power plant safety is based on the 
defence in depth concept. For this reason, the review carried out was to the extent possible structured 
and performed in terms of the performance and integrity of basic safety functions and the protection 
of the physical barriers. 


TABLE 1. 


PLANTS: STATUS BEFORE AND AFTER RECONSTRUCTION 


Kun | қшыл | бшшзшз | 


Modification 


1. EMERGENCY CORE COOLING 
SYSTEM 


Cooling pumps for damaged 
part of reactor 


Cooling pumps for 
undamaged part of reactor 


Accumulators 
(water volume, 
1 accumulator) 


Distribution group headers 
check valves 


Emergency feed pumps 


Headers and pipes of ECCS 


2. PRESSURE BOUNDARY 
INTEGRITY MONITORING/ 
CONTROL 


Automated NDE 


Leak detection (humidity, 
radioactivity, acoustic) 


3. OVERPRESSURE PROTECTION 
SYSTEM (max. number of 
failed fuel channels) 


Present status 


After I. reconstruction stage, 
2 safety valves,2 pipes Ø 
400 mm 


After II. reconstruction 
stage, 2 pipes © 600 mm 
(need to cut biological 
shield), redundant support 
system 


4. RADIOACTIVE RELEASE 
PROTECTION SYSTEM 
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MAJOR SAFETY RELATED MODIFICATIONS OF RBMK NUCLEAR POWER 


Objective 


Reliability and 
scope of ECCS 
upgrade 


Early leak 
detection, 
prevention of 
brittle failure 


(System tested 
at Leningrad !) 


Reactor cavity 
overpressure 
protection for 
simultaneous 
failure of given 
number of fuel 
channels 


Reduction of 
radioactivity 
release to 
environment 


TABLE 1. (cont.) 


Modification 


5. BUILDING FOR RELIABLE 
POWER SUPPLY 


Remote shutdown panel 


Diesel generators 


Independent power supply 
trains 


6. FIRE PROTECTION 
UPGRADES 


7. WATERSUPPLY FROM 
EXTERNALSOURCES (FOR 
SEVERE ACCIDENTS) 


Service water 


Underground water (artesian) 


Independent line from reliable 


source (lake) 


8. STRUCTURAL UPGRADES 


Reactor hall structural and 
leak tightness upgrade 


9. CPS AND I & C UPGRADES 


10. SEISMIC RESISTANCE 
IMPROVEMENT 


11. ADDITIONAL SCRAM SIGNAL 


Shutdown margin 
Low flow on DGH 


Pressure drop in main 
circulation circuit 


12. AUTOMATED ON-SITE 
RADIATION MONITORING 


13. GENERATOR BREAKERS 


14. DISCONNECTION OF 


GENERATOR FROM GRID FROM 


CONTROL ROOM 


15. UPGRADING OF DRAIN 
SYSTEM 


16. ECCS UPGRADE - 


ADBITIONAL WATERTANK 
Note: AT - additional tanks 
NN - not needed 
+ = implemented 
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TABLE II. PLANT SPECIFIC STATUS 


m Number of Fuel Chanel 
еее БЕ RR 1693 
Leningrad 2 | 1 [ont | maw 163 
ЕШТЕ ИНИСИ ГНИ 1661 
a E л isi 
smotenk 2 | 2 | perio’ | a | m 
Smolensk 3 m m [m | iss 
Ignalina 2 e operational 1661 


The review was conducted addressing the technical areas mentioned in four parallel working 
groups. The meeting was attended by 28 safety experts from 13 countries and the CEC and 16 RBMK 
specialists from Russia, the Ukraine and Lithuania. 


The following chapters present the findings and recommendations for the four technical areas 
reviewed. Appendices I-IV reflect the results of daily discussions and provide more detailed 
information on the reviews performed. In Tables I and II the list of modifications summarized by 
RBMK specialists is given, along with selected plant specific characteristic features. Figures 1, 2, and 
3 show the RBMK plant cross-section, elevation and flow diagram. 
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Reactor 9 Reactor inlet water pipes 
Fuel channel upper tract 10 Burst-can detection system 
Steam/water pipes 11 Upper biological shield 
Steam separators 12 Side biological shield 

Steam headers 13 Lower biological shield 
Downcomers 14 Irradiated fuel storage pond 
Main circulating pumps (MCP) 15 Re-fuelling machine 

Group distribution headers 16 Bridge crane 


FIG. 1. 


Sectional view of RBMK 1000 nuclear power plant. 
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Reactor Hall 
Turbine Hall 
1 Re-fuelling machine 
2 Reactor 6 Suction header 
3 Pressure header 7 Reactor inlet water pipes 
4 Main circulating pumps 8 Steam drums 


5 Downcomer pipes 9 ALS pools 


FIG. 2. Elevation of RBMK 1000 nuclear power plant. 
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FIG. 3. 


13 Group distribution header 
14 Isolation and control valve 
15 Mixer 

16 Feedwater valve assembly 
17 Steam headers 

18 Main relief valve (MRV) 
19 Steam dump valve 

20 Turbine trip valve 

21 Turbogenerator 

22 Condenser 

23 Condensate pump 

24 Condensate purification 


25 Heater 

26 Deaerator 

27 Auxiliary feedwater pump 
28 Feedwater pump 

29 Blowdown regenerator 

30 Cooldown pump 

31 Blowdown afterheat 

32 Bypass purification 

33 ALS pool 

34 Emergency water tank 

35 Emergency feedwater pump 


Flow diagram of RBMK 1000 nuclear power plant. 


2. CORE MONITORING AND CONTROL 


The main changes since the Chernobyl accident are related to the protection functions based 
upon neutron flux measurement. This appears to be because the Chernobyl accident was a reactivity 
induced accident, which has influenced much of the backfitting work. There have been several 
modifications implemented which have resulted in a reduction of the positive void coefficient and 
mitigation of its effect under accident conditions. After the introduction of the "urgent measures" to 
improve safety, several longer term items were identified. These additional measures are currently 
in various stages of implementation. Review of the information presented at this meeting indicated 
that the following items are still in progress. Some future modifications were also identified during 
the meeting. The status of many of these modifications is summarized in Tables VI and УП of 
Appendix I to this report. 


2.1. | DESIGN MODIFICATIONS 
Implemented 


- introduction of approximately 80 additional fixed absorbers (52 for Ignalina NPP); 

- increased operational reactivity margin (ORM) and increased minimum ORM; 

- introduction of 21 to 24 fast acting control rods, which constitute the fast scram system (FSS) 
with an insertion time of 2.5 s; 

- increase in the number of bottom inserted rods, all of which are now inserted when the scram 
occurs; 

x modified control rod design to eliminate the positive scram which contributed to the 
Chernobyl accident; 

- increase in speed of insertion of control rods from about 19 s to 12 s; 

- ORM calculation is made every 5 minutes, instead of every 15 minutes; 

- improvements in the computational capabilities of core physics codes; 

- strengthening of administrative procedures. 


Under way 


- increase in fuel enrichment from 2.0% to 2.496 (currently being introduced on all plants 
except Ignalina); 

- installation of the modified control rods for first generation plants; 

- "modernization" of the control and instrumentation system. 


Planned 


- an additional fast acting shutdown system potentially using “Не injection; 

- further enhancement of the control and protection system (CPS) cooling system to reduce the 
maximum reactivity insertion resulting from system failure; 

- new scram signals based on reactivity margin; 

- graphite stack mass reduction by 20% for Kursk 5. 


The effect of these modifications has been reviewed and results in the following findings. 


2.2. | FINDINGS 
- All of the fixes which have been made to the CPS and ORM appear to be good and should 


result an the improvement of the safety of RBMK reactors. Overall, these design changes 
should increase the safety of the reactors in many respects, but it was not evident to the 
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western experts that the proposed changes will not reduce the safety margins in other respects. 
The material presented does not include all the details of the analyses used to make this trade- 
off between increased safety and possible reduced safety margins. The proper assessment of 
the real trade-off of the competing and interacting design fixes requires three-dimensional 
analyses. 


There is a plan to increase the number of redesigned control rods in the future. The 
redesigned control rods are also to be implemented at the RBMK second generation plants. 


With the addition of the 80 permanent absorber rods, using conservative initial conditions such 
as minimum ORM of 30 rods, fuel enrichment of 2.0%, shortest channel voiding time, etc., 
the analysis shows that the resulting void reactivity effect is 1.78. With an ORM of 45 rods, 
the effect is 1.20. The actual effect has been measured as 0.88 with the 2.4% enriched fuel, 
which has been added to date. This latter value is within the capability of the shutdown 
system and is a very significant reduction from the value prior to the backfitting measures 
being implemented. 


Neutronic calculation capability has been improved by the introduction of codes such as 
WIMS D4 and MCU. These codes have been used to improve data and validate existing 
Russian codes by comparison exercises. Developments are under way to make further 
improvements by the introduction of more 3-D codes for both dynamic and fuel management 
calculations. 


In general it appeared that the monitoring and protection systems were much better organized 
and more comprehensive in scope than was apparent from the material prepared for the 
review. 


The monitoring of plant parameters and processing of plant information were found to be 
extensive. The SKALA and TITAN computer systems would appear to be overloaded and 
currently have a slow cycle time, e.g. update of flow every 40 seconds and dryout margin 
every 5 to 15 minutes. The efforts and actions to accelerate the rate of data processing and 
information updating are supported by the experts. 


A complicated combination of manual control and automatic control is utilized to maintain 
total reactor power, as well as the power distribution. The SKALA central monitoring 
system, as well as other instruments, provide the operator with information concerning the 
power level and power distribution. The SKALA system, which provides updated information 
every 5 minutes, is designed to provide guidance to the operator for steady state control of 
the power distribution. There is a very heavy reliance by the operator on accurate information 
being presented by the SKALA system. 


The SKALA system also calculates the ORM. The ORM is expressed in terms of the number 
of "equivalent" control rods remaining within the core. This definition is not precise, but the 
ORM is very important to safety because of its effect on the void and power coefficients. It 
was also noted that when a violation of the ORM occurs, the operators are only required to 
scram by following an administrative procedure, since this has not been implemented into an 
automatic engineered safety feature. 


There is a heavy dependence on operator actions to ensure plant safety. 


The procedures and practices for refuelling the reactor, as described in the material presented, 
are comparable to those used for on-power refuelling in Canada. 


The change of manual shutdown button, from one that had to be manually held down until the 
plant was shut down, to one that need only be pressed once is most justified. The actions to 
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reduce the time for rod insertion and to enhance the speed with which the reactor is shutdown 
are supported by the experts. 


The shutdown algorithms require further study by western experts and the links to the accident 
transients and to the plant safety case must still be made. The approach to proof and periodic 
testing as well as the role of such testing when making the high claims for shutdown system 
reliability should be discussed additionally. 


The division of the control rods of the same function among the six power supplies was 
considered as good practice, but there remains the question of the extent of segregation of the 
cable runs and the location of processing equipment. 


Calculations of the power pulse resulting from channel voiding take into account electronic 
delays (0.1 s) and actual rod drop times (2 to 2.5 s) as measured both experimentally and at 
NPPs. The electronic delay time seems small. 


In pipe break scenarios, all reactor power levels have been considered, even below 20% 
where power operation is forbidden, and the results presented show power pulses within 
acceptable ranges. 


Rod withdrawal accidents cause a peak in the neutron flux in the vicinity of the withdrawn 
rod. If this type of accident is analysed assuming the control and protection system works, 
then the flux distribution changes due to insertion of other rods in the vicinity. Depending 
on the specific conditions, the flux distribution can actuate either the local control system or 
cause the power scram system (PSS) to activate. The effectiveness of the response of these 
systems depends upon whether there is a 7, 9 or 12 zone control system and where the 
location of the rod is relative to the detectors. In the case of Kursk, there is only an out of 
core control system so coverage will be poorest in that reactor. 


The power peaks resulting from rod withdrawal are calculated using very conservative starting 
assumptions. The results presented show that for the majority of cases considered, the targets 
of maintaining the cladding temperature below 1200°C and preventing fuel melting are 
achieved. Only in the case where all conservatisms are used, will very limited fuel melting 
occur in one channel for those reactors with 8 zone control systems. "Therefore, for those 
reactors, an administrative procedure has been instituted which requires that the drive 
mechanisms be electrically disconnected when some of the central rods are fully inserted. 
This procedure is followed at Kursk NPP. 


Protection against loss of water from the CPS cooling circuit is covered by 3 parameters, 
related to pressure in the header, water flow rate and level of water in the upper tank, which 
initiates water makeup to systems with breaks. The specific rate of water loss depends upon 
the design of CPS rods and their position in the core. The control rod design change has 
reduced the positive reactivity insertion from about 48 to 58 to about 2.58. Even though this 
is close to the capability of the FSS the results of the analysis presented show that maximum 
rate of reactivity addition is 0.125 fi/s. Obtaining of acceptable results from the analysis of 
this event is clearly dependent on the accuracy of the codes used to predict the rate of 
discharge of water from the channels. This needs to be confirmed by further experiments, 
or ways of physically reducing the rate of reactivity addition need to be found. 


There was no discussion of accidents involving faulty ECCS initiation, gas ingress from the 
ECCS accumulators to the core and group rod withdrawal, although it was stated that the 
group rod case would be easier to detect and compensate for because of the larger 
perturbation. 


The number of channels with 2.495 fuel enrichment varies from unit to unit as summarized 
in Table VII. There is no plan to load 2.4% enriched fuel into the Ignalina cores. 


- Modified control rods are being installed on all first generation units (Table VII). The number 
of bottom entry rods has not been increased to 32 on first generation units, because it gave 
rise to problems in maintaining the reactor subcritical on shutdown. 


- A modernized version of the control and instrumentation system has been developed and 
should be installed starting in early 1993. This new system has increased diversity and 
segregation of functions and a more rapid cycling of the data acquisition system. Additional 
protective functions are contained in the new system, for example actuation of the FSS in 
response to signals from in-core detectors. 


From the limited discussion of the details of these modifications during this meeting, all were 
perceived to be positive steps towards enhancing the safety of RBMK reactors. 


2.3. | RECOMMENDATIONS 


In the light of the discussions concerning all of the above modifications to systems and 
analytical calculations the following recommendations were made: 


- Selected information from the extensive references quoted in the supporting documentation 
should be made available for independent review to enhance western experts’ confidence in 
the significant improvements reported at this meeting. This review will require extensive and 
detailed discussions. 


- Efforts to improve 3D-methods for neutronic calculations and static and dynamic analysis of 
power distribution should be continued and extended to cover fuel management. A common 
approach agreed by RBMK and western specialists should be used. 


- Further review should be undertaken by Russian authorities to minimize the high reliance of 
safety functions on operator action. An increase in the scope of automatic functions may be 
warranted. 


- The RBMK designers should be encouraged to introduce additional instrumentation and 
control devices, where such additions can be shown to improve safety. 


- Further studies should be undertaken to remove the necessity to maintain sufficient ORM in 
order to have an acceptable void coefficient. 


- The replacement of the ORM concept, which requires too much operator involvement, should 
be further explored. 


- Additional information on the control and protection strategy adopted for RBMK plants should 
be provided. In particular it is necessary to identify the design requirements of the safety 


systems and clearly link them to the safety case. 


- The implications of the change in local power control system, e.g. with regard to change in 
detector type and introduction of 12 zone controllers, should be peer reviewed. 


- The data processing computers should be upgraded and better alarms and displays installed. 


- Integrated reviews of both the neutronic and thermal hydraulic studies are needed since there 
is significant interaction between them. 


- Independent calculations should be undertaken, using typical western safety analysis 
assumptions, to assess the margins which would normally be expected when using such 
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assumptions. Comparative analysis of RBMKs and relevant western plants should be carried 
out, based on results of independent calculations. 


Further experiments are needed to understand the blowdown characteristics of the main 
circulation circuit and of the whole heat transport system and their effect on reactivity 
addition. 


Procedures for experimental measurement of important plant safety parameters, e.g. void 
reactivity coefficient, should be reviewed. 


The modernization of the CPS should proceed expeditiously since the reported improvements 
would provide considerably better coverage of rod withdrawal accidents and for single channel 


failures when fast response detectors are installed. 


The effectiveness of the fast acting shutdown system should be increased to enhance the safety 
margins for reactivity induced accidents. An optimization study is necessary. 


The completeness and appropriateness of the safety criteria being applied to the RBMK should 
be reviewed. 


No attempt has been made to rank the order of the recommendations. It was deemed not 


possible to make such a ranking as the experts did not have the comprehensive overviews of the plant 
and its safety which would be required to prioritize the recommendations. 
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3. PRESSURE BOUNDARY INTEGRITY 


The subject of the pressure boundary was reviewed on the basis of the four subject areas, 
Design of Fuel Channels, Reactor Coolant System Design, Reactor Pressure Boundary Inspection and 
Leak Before Break Concept. The Reactor Coolant System Design was further divided into the 
primary and the steam circuits. The complete circuit design, as well as the modification status, was 
covered on the basis of the information presented verbally and in writing by the ЕВМК specialists. 
The working atmosphere was cordial, co-operative and very open, and the limits in information were 
governed by the limits to the knowledge of the participants. 


The recommendations on the system are mainly in the areas of additional analysis, verification 
inspections of the systems, and peer reviews on analyses already carried out. Recommendations were 
also made in an attempt to improve containment confinement and to consider automatic regulation of 
valves. 


The recommendations on improvements were in the areas of peer review of the improvements, 
of continuing to work on the analysis of the leak before break concept, and of high reliability leak 
detection systems if leak before break is to be used for reactor safety justifications. 


3.1. DESIGN MODIFICATIONS 


Several modifications have been implemented to enhance the pressure boundary integrity at 
RBMK nuclear power stations; some are under way and others are being studied. 


Implemented 


- Some 46 fuel channel tubes have leaked in the dissimilar weld region and have subsequently 
been replaced. Leakage was from stress corrosion cracks in the stainless steel section of this 
weld, associated with low titanium concentrations. 

- Delayed hydride cracks (DHC) have been observed on the outside diameter of fuel channel 
tubes. Growth of DHCs has been associated with high residual stresses, induced by the 
former method of straightening tubes. The method used at present has overcome this problem 
(reduction of residual stresses). 

- Some steam/water pipes supports have been added to deal with the situation observed related 
mainly to piping vibration. 

- In the past an acid medium was used for decontamination of the circuit but was found to 
corrode the carbon steel component sections and the practice has been discontinued. 

- A simplified engineering approach, the strain intensity factor concept and limit stress approach 
have been used to develop tables of allowable flaw sizes, which regulate which flaws must be 
repaired upon discovery during in-service inspection. 

- Probabilistic fracture mechanics calculations have been performed for the 800 mm pipe to 
predict leak and rupture probabilities. Failure of this piping has the severest consequences 
should a large break occur. 


Under way 
- A new design of flow control valve is being installed at all plants, as a measure to prevent 


ruptures of fuel channels that have been caused by lack of coolant flow when valves have 
malfunctioned. 
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A sample of fuel channels is now being inspected at all plants by ultrasonic and eddy current 
methods; these inspections are in addition to continuing hot cell examinations of fuel channels 
which are being removed for purposes of material properties studies (surveillance samples 
manufactured of fuel channel metal are also studied). 

Fuel channels are being (or will be) replaced at all plants with new channels (of essentially 
the same design) after service exposure (creep) has resulted in closure of the gap between the 
channel tube and graphite. This extends the service life under the same operating conditions 
and to a limited extent improves safety due to enhanced pre-service inspection capabilities. 
Seismic analyses of the pressure boundary are being performed for all plants on a site specific 
basis to resolve concerns with previous generic evaluations of seismic effects. 

Automated equipment has been developed for inspection of the main circulation circuit welds. 
This equipment with imaging techniques for data display is being used on a pilot basis at the 
Leningrad plant before being implemented at all RBMK units. 

The leak before break (LBB) was not the technical basis for the RBMK safety concept. 
However, analyses of LBB are in a state of development and will be used to properly 
distribute resources (e.g. leak detection versus ultrasonic detection of cracks). 

Evaluations of severe wind loads are performed on a plant specific basis. 


Planned 
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A new regulatory document on fuel channel inspection is being prepared. 

Tests of the effects of tube burst on adjacent tubes have been proposed. A 5x5 full-scale 
mockup of cells has been constructed at a facility in the Ukraine, but the tests have been 
delayed following the dissolution of the Soviet Union. 


FINDINGS 


Only three incidents of ruptured channels have occurred during operation but no beyond 
design basis accidents have occurred to date (no leaks in adjacent channels). There have been 
73 cases of detectable leakage resulting from through wall cracks smaller than critical size. 


Operation of the refuelling machine was also reviewed in detail including the methods of 
sealing both the channel closure and the refuelling machine. Seismic qualification of channels 
and the refuelling machine is of concern. 


The main circulation circuit is mainly of stainless steel, although there are some carbon steel 
valves; the second circuit is mainly carbon steel. Leak detection has been used to monitor 
both fuel channels and the primary coolant circuit, and the detection methods have been 
effective in finding leaks in degraded RBMK components. 


Non-destructive examinations (NDE) of fuel channels by ultrasonic testing (UT) or other 
methods is only now being implemented at all plants, and will only inspect a small sample of 
channels when implemented. Leak monitoring will remain the main method of detecting 
degraded tubes. 


Leak before break evaluations have been performed on a generic basis, with inspection data 
from Ignalina used to support evaluations. No modifications to plants have yet been made or 
proposed based on LBB evaluations. 


Continued evaluations of the leak before break concept are being performed and the results 
of these studies will help define the requirements for improved systems for leak monitoring. 


2:3, 


RECOMMENDATIONS 


Volumetric 100% inspections of the fuel channels should be considered for implementation 
to analyse the development of sub-critical cracks. An eddy current type of device carried by 
the fuelling machine may enable this inspection to be done with each fuel change. 


Precise methods of prediction of the gap between the fuel channel and the graphite stack 
should be developed on the basis of graphite and tube behaviour. 


Fail safe characteristics of replacement flow control valves should be fully verified. 
Modifications should be considered to allow non-operator-initiated response to flow 
restrictions. 


The inspection programme should be optimized by identifying the most risk significant 
location. This could lead to more effective inspection programs with fewer inspections, but 
of a higher level of reliability. Activities already under way in this direction should be 
encouraged. 


The possibility of backfitting better containment-confinement systems should be studied. 


The site specific seismic analyses should be peer reviewed, and any weaknesses indicated in 
equipment or support should be corrected and improvements backfitted. Of special interest 
is the support of the refuelling machine, which should be analysed to maintain a condition of 
remaining locked on to a channel during a seismic event without leakage or any damage to 
the channel or the machine. 


The joint and nozzle connection of the feeder tubes (diameter 68 mm) to the steam separators 
should be further studied for the effects of ageing. 


New methods of decontamination of the circuit should be developed to reduce radiation 
exposure of the in-service inspection personnel without eroding the material of the circuit. 


The effectiveness of NDE methods should be more extensively established through 
performance demonstrations on specimens with realistic service type defects. 


The inspection of the main circulation circuit should be carried out regularly (100% UT every 
4 years). Steam pipes between the separators and the turbine stop valves, and the feedwater 
lines between the separator and the feedwater control valves should also be inspected 
sufficiently. 


Currently available results related to application of the LBB concept do not provide a basis 
for decisions on RBMK safety. 


Development of the analysis method for pipe rupture, including zirconium, stainless steel, and 
carbon steel materials and taking into account earthquakes, should be continued and the 
probability analyses should be conducted for each specific equipment layout. 


Providing that the LBB concept is to be applied, plant specific work completed and planned 


should be analysed and peer reviewed, including stress analysis, fracture analysis, stability 
analysis, integrity analysis and leak detection methods. 
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4. ACCIDENT MITIGATION 


In the area of Accident Mitigation the review was split into four parts covering Emergency 
Core Cooling System, Loss of Coolant Accident Analysis, Confinement and Reactor Cavity 
Overpressure Protection System, covered in Sections 4.1 to 4.4. 


4.1. EMERGENCY CORE COOLING SYSTEM 


The focus of the discussions was on understanding the basic design and function of the 
emergency core cooling system (ECCS) for the various RBMK units. Three reference plants Kursk 1, 
Ignalina 2 and Smolensk 3 were addressed; however, there were some limited discussions on other 
units (especially Leningrad 1 and Chernobyl 1, since the safety improvements have been implemented 
mainly to these units). 


The specific upgrades or modifications that have been proposed by the RBMK specialists were 
also discussed. In general these upgrades are intended to improve the ECCS for the Ist generation 
of RBMKs to be comparable with the 2nd and 3rd generations. 


In general it seems that all of the proposed modifications are safety improvements and will 
enhance the capacity and redundancy of the ECCS for the Ist generation RBMK units. However, the 
review was of insufficient detail to assess whether or not these upgrades fully address all the demands 
placed on the ECCS for the full spectrum of accident scenarios (1st generation RBMK). 


4.1.1. Design modifications 


The specific modifications addressed during our meeting are shown in TableI. Those relating 
to improving the ECCS are items 1, 7, 11, 15, and 16 and are described briefly below: 


Item 1 - ECCS improvements 
This item includes several different improvements as follows: 


- Increasing the number of EFPs from 3 to 5 and the number of ECCS lines from 1 to 2 (1st 
stage). 

- Installing additional ECCS pumps (3 for damaged core side cooling and 3 for undamaged core 
side cooling) and the associated 3 divisions of piping (2nd stage). 

- Installation of check valves between the distribution group headers (DGH) and the main 
coolant pump discharge header. 

- Installing additional, larger capacity accumulators. 


Item 7 - Additional water sources 


In Kursk 1 NPP the capability to make use of diverse external water sources for ECC injection 
has already been implemented (service water connection, artesian wells suction). Further 
improvements have been planned for all the considered plants in order to make emergency water 
supply from external sources (i.e. lakes) available without any need for energy from in-plant energy 
Sources. 


The main purpose of the above modification is to enlarge the spectrum of beyond design basis 
accidents the plants will withstand. 
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Пет 11 - Safety system actuation 


Additional scram signals are planned to be included in the reactor protection logic in order 
to introduce new automatic trip signals and to diversify physical parameters able to initiate scram in 
some critical scenarios. 


During the discussion of ECCS initiation logic, a similar improvement has been found to be 
effective for these logic. 


Some ECCS initiation logic depend on the monitoring of a single physical parameter (e.g. 
drum separator level), and for some events both the scram and the ECCS rely on a single physical 
parameter (e.g. pressure increase in a compartment room). 

Item 15 - Drain system upgrading 

This concerns the installation of an additional tank to store the water drained from the lower 
room located below the reactor cavity. This tank is to be added to the plants of the Ist generation. 
Its main purpose is to prevent flooding in this area. 

Item 16 - ECCS water supplies 
Incorporation of an additional source of water of about 2000 m* from where the ECCS pump 


could take suction. This will ensure the availability of cooling water for a longer period of time. This 
modification is planned for the first generation plants. 


4.1.2. Findings 

- Regarding the specific upgrades discussed, it was agreed that all the upgrades are safety 
improvements and will enhance the capacity and redundancy of the ECCS for the lst 
generation RBMK units. 

- It was also found that there has been insufficient information presented to assess whether or 
not these modifications will fully address the demands placed on the ECCS for a full spectrum 
of accident scenarios, including those intended to be covered by the planned improvements. 

- It should also be noted that there has been insufficient information presented to assess whether 


or not the ECCS for the 2nd and 3rd generation units is adequate to fully address the demands 
placed on it for a full spectrum of accident scenarios. 


4.1.3. Recommendations 
In general our recommendations fall into three categories: 
- Implement the proposed modification; 


- Perform additional studies or analyses to fully assess the scope of the proposed modification, 
especially with respect to potential improvements beyond those identified; 


- Provide additional information, or analysis, to allow independent verification that all 
deficiencies have been identified and addressed. 
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4.2. 


4.2.1. 


LOSS OF COOLANT ACCIDENT ANALYSIS 
Design modifications 


Various design modifications to the ECCS and confinement have been implemented or planned 


to better protect the plant against a loss of coolant accident. These modifications are discussed in 
other sections. 


4.2.2. 


4.2.3. 
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Findings 


The RBMK specialists consider the worst design basis LOCA to be guillotine rupture of a 
pressure header with failure to close the check valve of one distribution group header. The 
RBMK specialists consider partial pipe/header ruptures to be highly improbable in that any 
partial break capable of heat removal deterioration is assumed to be greater than the critical 
crack length and therefore will result in complete guillotine rupture. However, partial breaks 
could result in periods of flow stagnation in one or more fuel channels which would result in 
a fuel cladding temperature in excess of those quoted in the reference design basis LOCA 
analysis. A pipe/header rupture combined with a seismic event could also pose problems if 
some of the mitigating systems credited are not adequately seismically qualified. 


The use of the 1200°C maximum fuel cladding temperature criterion in assessing the 
performance of ECCS for a channel type reactor such as the RBMK is conservative and 
possibly unnecessarily restrictive. The criterion was derived for the typical light water reactor 
pressure vessel type design. 


Further evidence is needed to demonstrate ECCS equipment and confinement components will 
not be disabled by cross link effects in the short as well as in the long term. Cross link 
effects include environmental effects such as flooding, condensation, temperature, pressure 
and radiation, or dynamic effects such as water hammer, pipe whip and fluid jets. 


The many probability and reliability claims in the reports require reliability analysis support 
and/or justification of applicability of the data used. 


Further information is needed for the following: 

(a) airborne and possibly waterborne leakage of radioactive materials from areas such as 
the confinement compartment envelope, safety relief valves and ECCS equipment, 
particularly long term ECCS equipment; 


(b) assumptions about radioactive releases, such as fission product distribution, washout, 
plateout and charcoal filter efficiency; 
(c) exposure calculational assumptions such as weather scenario, location and exposure 


time duration for the most exposed individual. 


For the computer codes used in the LOCA analysis, documentation describing the following 

is required: 

(a) the physics, mathematical models, empirical correlations and simplifying assumptions; 

(b) validation, including benchmarking against standard or analytical problems, 
comparison against pertinent experimental data and actual RBMK transients during 
commissioning and operation and ‘blind’ testing against relevant test data. 


Recommendations 


Channel reactor, PWR and BWR safety specialists should have further discussions with 
RBMK safety specialists to rationalize the definition of design basis LOCAs for the RBMK 
and to identify the worst design basis LOCA sequences. 


- Channel reactor, PWR and BWR safety specialists should meet with RBMK safety specialists 
to review whether the use of PWR/BWR ECCS performance criteria in the safety assessment 
of a channel type reactor such as a RBMK is technically appropriate. 


- Separate reviews in the form of specialist meetings should be held to clarify the following 
subject areas: 


(a) cross link damage; 

(b) reliability analysis; 

(c) radioactive release calculation; 

(d) computer code documentation and validation standards; 
(e) human factor engineering and operator models. 


- An independent review of available probabilistic safety assessments (PSA) of RBMK reactors 
should be performed prior to using the results in support of safety decisions. 


4.3. CONFINEMENT 


The reactor coolant system of Ist generation RBMKs is not enclosed in a leaktight accident 
localization system (ALS) similar to the 2nd and 3rd generation plants. Even in the 2nd and 3rd 
generation nuclear power plants, only a part of the reactor coolant circuit is confined by a system of 
pressure compartments of an accident localization system. The rooms where the steam/water lines, 
the steam drum separators and the upper parts of the downcomers are located are not included in the 
ALS. 


4.3.1. Design modifications 


For RBMK plants of the Ist generation a decision was already made to construct a separate 
building housing a pressure suppression system. This building shall be connected to the reactor 
building. It was said that the pressure suppression system capability for LOCA will be similar to that 
of the accident localization systems of the 2nd and 3rd generation plants. 


Furthermore, investigations regarding the strengthening of the reactor building structure, 
including the roof of the central reactor hall, are being discussed by the RBMK specialists. Also being 
discussed is the installation of a leaktight compartment system for the rooms of the steam/water 
pipelines, the steam separators and the central reactor hall. 


4.3.2. Finding 


- The defence in depth concept with respect to confining the reactor coolant circuit was not a 
basis for the design of the Ist generation of RBMKs. The defence in depth concept was also 
not consequently applied to the 2nd and 3rd generation plants where the upper rooms 
confining parts of the reactor coolant circuit form practically no leaktight barrier to the 
environment, especially in the event of a loss of coolant accident in these unsealed rooms. 


4.3.3. Recommendations 
- The decision to create a pressure suppression system for the RBMKs of the Ist generation 


with an efficiency similar to that of the units of the 2nd and 3rd generation is supported by 
the experts. The construction of a separate building seems to be an appropriate way. 
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- It is recommended to upgrade the upper rooms (reactor hall, steam separator rooms, etc.) with 
respect to leaktightness and confinement function. It is suggested that the discharge from 
these rooms in the event of a break in the reactor coolant system could be directed into the 
pressure suppression system or to a filtered ventilation. 


- In accordance with the international practice, consideration should also be given to the 
installation of steam line isolation valves. 


4.4. |. REACTOR CAVITY OVERPRESSURE PROTECTION SYSTEM 


Protection of the reactor cavity against overpressurization is an important safety feature of the 
RBMK. Cavity pressure exceeding 3.1 atm absolute has been described as having the possibility to 
lift the upper head/biological shield assembly, breaking the reactor seal, breaking (simultaneously) the 
pressure tubes, and affecting the operation of other safety features. The existing overpressure 
protection system has capacity for two or three channel tube ruptures (for first and second generation 
units, respectively) which reflects a safety margin over the design basis accident of one channel tube 
rupture. The existing steam discharge system vents the steam/gas mixture from the cavity to a 
condenser with subsequent gas holdup and release through the gas clean up system/stack for first 
generation units. For second and third generation units, the discharged steam/gas mixture is 
discharged into bubbler/condenser pools where the steam is condensed, and gas is retained in the 
leaktight spaces. 


4.4.1. Design modifications 


There is an intention to improve the capacity of the cavity overpressure protection system. 
This work is being conducted in stages which are either completed, under way, or planned for all units 
concerned. 


1st construction stage - A modest increase in capacity amounting to one or two tubes of additional 
relief is achieved in the first stage by adding two vent valves to existing cavity steam discharge pipes 
at the top of the reactor. These valves vent the reactor space to atmosphere upon reaching 2.8 atm 
absolute pressure in the cavity. 


2nd construction stage - A further increase in capacity to simultaneous rupture of nine tubes is 
achieved by addition of a new 600 mm steam discharge pipe into the cavity. This pipe also has two 
atmospheric vent valves, and additionally is routed to bubbler/condenser pools where they exist. 


3rd construction stage - New buildings containing bubbler/condenser pools in sealed areas are planned 
for first generation units. When existing, the 600 mm steam discharge line would be routed to these 
pools, eliminating the need for atmospheric vent valves. 


4.4.2. Findings 


- It is apparent that the modifications being implemented increase significantly the capacity of 
the overpressure protection system (up to nine simultaneous tube failures). However, this is 
still small compared to the number of channel tubes passing through the cavity (> 1600), and 
is even small compared to the minimum number of channel tubes supplied from a common 
header (43). So the adequacy of the upgrade must be judged in relation to accident sequences 
having the possibility of resulting in multiple tube ruptures. 


- Results of accident sequences analyses were presented by the RBMK specialists. For design 
basis accident (ОВА) sequences, the results indicated that no channel tube failures were to be 
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expected. The results of a limited set of beyond design basis accident (ВОВА) sequences were 
also presented. Here the initiating event together with an additional safety system failure was 
analysed and probabilities assigned. The probability of arriving at a core damage state 
involving multiple tube ruptures was given as 6 x 107 summed over all the events analysed. 
The technical basis for this result could not be verified. The conclusion of the RBMK 
specialists was that there was no design basis for multiple tube ruptures, and the basis for the 
modifications is to achieve the largest reasonably achievable margin compared to the design 
basis of one channel tube rupture. A question also remains as to whether there might be other 
sequences which would be more threatening to pressure tube integrity, especially for multiple 
tube failures. 


A small net gain in discharge capability is achieved at the expense of an uncontrolled release 
directly to the atmosphere. 


The reliability of operation of the atmospheric vent valves cannot be established in situ. The 
range of opening pressures was not described, there was uncertainty over the reliable closing 
of the valve, and the valve would not be expected to reseal. 


The approach that was presented at the meeting to vent the discharge lines to 
bubbler/condenser pools precludes the need for atmospheric venting upon completion of the 
third construction stage. 


Recommendations 


The RBMK specialists should proceed with high priority to complete implementation of the 
improvements to the cavity overpressure protection system. 


Additional analyses should be performed for sequences, based on international experience, that 
are most severe in terms of pressure tube integrity. The results of these analyses should be 
subjected to peer review, and selected audit calculations should be performed to support the 
analysis methodology and results. The purpose is to establish a definitive design basis for the 
cavity overpressure protection system. 


The boundary conditions for survival of the tubes should be identified, based on a combination 
of temperature, internal pressure and rates of temperature increase or decrease during the 
sequences, taking account of any particular features of the tubes such as welds or metallurgical 
deterioration. 


The RBMK designers should proceed with high priority to provide bubbler/condenser pools 
at first generation units, together with completion of the second stage of improvement, which 
will eliminate the need for the atmospheric vents. 


The designer should present results of a series of functional tests on prototypes of the 


atmospheric vent valves carried out to establish performance characteristics, recognizing their 
existence only as an interim feature. 
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5. ELECTRIC POWER SUPPLY 


It is understood that comments by the IAEA consultants on RBMK NPP documentation 
available and meetings with RBMK NPP design and operation engineers were not intended to be an 
exhaustive safety audit. 


The intent of the review was to highlight the existing or potential safety shortcomings in the 
design of the electrical systems and to suggest ways to improve the general or specific safety 
situations. The limited information and time available made it possible to cover to a certain depth 
only some fields of prime safety interest. From the information in the supplied documentation, from 
the Figs 20-27 in Appendix IV and the discussions, the 3rd generation design of electric power 
circuits, at all levels from switchyard down to basic battery supplies, appears to be able to meet the 
usual high level requirements. However, relevant safety aspects were not addressed, such as: 


(a) Safety and safety related load coverage by electrical safety and safety related power 
supply systems; 

(b) Sizing and design margins of safety and safety related equipment such as transformers, 
buses, etc.; 

(c) Related situations that could affect safety or safety related equipment, systems or 


trains separation, brought about by fire exposure, flood, pipe whip or jet impingement 
effects, seismic interaction of non-qualified on qualified structure and equipment, etc.; 


(d) Human factors considerations, such as minimum postulated time before operator's 
action following accident, and co-ordination actions between different site control 
rooms; 

(e) Testing and maintenance conditions of electrical equipment in general. 


There are indications (the Kursk ASSET report for one) that the realization of the design and 
its long term operation and maintenance will require further study to verify that safety design 
requirements have been fulfilled. 


The changes which were made from the Ist generation design and the backfitting proposals 
described and illustrated in the next sections indicate an awareness of problems. Some areas of 
concern which were discussed in varying levels of detail are pointed out. 


5.1. | DESIGN MODIFICATIONS 


Towards the end of the meeting the experts received a list of actions consisting of 14 major 
items (see Table XVII). Several items had been addressed and are included in our technical notes. 
Items not covered by the technical notes will be covered by the following comments. 


Items 4, 5, 10 and 14 fall into the category of operational reliability with no direct impact on 
safety systems; they are not commented upon. 


Item 6: - "Substitution of leaktight storage batteries for open ones". Not only will the new 
batteries be leaktight, they will have better seismic characteristics and reliability. 


Item 7: - "Substitution of water for gas for fire extinguishing in cable rooms". This action 
is supported by the experts owing to the better fire extinguishing performance of water based 
fire fighting systems. 


Item 8: - "Cable coating with fire retardant compounds". Cautions on the thermal effect of 
coating were discussed. 
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5.2. 


Item 12: - "Improvements in reliability of control circuits for high voltage breakers". After 
reading the ASSET report for the Chernobyl nuclear power plant to review the root causes 
of a safety significant accident that occurred on 11 October 1991 at Unit 2, experts were 
concerned about the following two aspects: 


- The high number of cable problems reported; 

- Generator No. 3 was reconnected to the power line 30 minutes after the turbine inlet 
valves were closed due to the failure of the main breaker controls. There is no 
automatic feature to open the disconnectors when the generator is tripped. 


FINDINGS 


Based on the review performed it was found that some significant differences between the 
three generations of RBMKs exist. From the first to the third generation of these reactors a 
systematic improvement in the basic design was noted, e.g., in the areas of safety system 
redundancy, usage of advanced technical systems and components and additional design 
requirements against internal and external events. 


The 3rd generation is an evolution over years of experience and has become a satisfactory 
target design for electrical systems of a nuclear power plant. RBMK designers recognize that 
the earlier generations must be brought up to a comparable target of safety and reliability 
wherever possible and the reviewers agree. The urgency with which this is being done was 
not clear as no schedules of modification plans could be obtained. 


Owing to the complexity, the number of different RBMK generations, and given time 
restrictions, the reviewers were not in a position to make an overall assessment of the design 
and layout principles of the electrical system. 


Qualification of electrical equipment under harsh environmental conditions was discussed. It 
was stated that the necessary equipment was qualified. But further and detailed discussions 
will be needed to assess this area of environmental qualification of equipment. 


The first generation RBMKs are not equipped with generator circuit breakers, but as part of 
a backfitting program, such breakers have meanwhile been implemented at Leningrad 1 and 
2. Within the subsequent generations of RBMKs, however, these generator circuit breakers 
are already installed. 


The experts discussed the event of the recent fire in Chernobyl 2 and were informed that the 
current design is being modified to remotely control the disconnector in the high voltage 
switchyard from the unit control room. The operating procedure should also require immediate 
confirmation of the disconnect opening. 


АП RBMKs are connected to the main grid via main transformers and standby transformers. 
Examination of the circuit diagram for the Kursk plant revealed a specific situation in which 
a single failure of one high voltage circuit breaker can lead to the loss of one turbine generator 
and its main grid connection at Unit 2 and one standby transformer of Units 3 and 4 at the 
same time (this, however, does not fail a safety function). 


As a consequence of the Chernobyl 4 accident, the automatic supply of the in-house loads 
from the main generators isolated from the main grid upon loss of voltage from the grid is 
now prevented by protective features, where this had been an administrative requirement 
before, thus causing the diesel generators to maintain power supply to essential loads over an 
extended period of time until power supply from the grid can be restored. 
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Under degraded frequency conditions however, the operator manually reduces reactor power, 
disconnects both generators from the grid and maintains in-house load by continuing to operate 
one of the two generators. Transfer from the unit transformer to a standby transformer is 
always a "slow" transfer (= 0.5 s) and special relaying is used to allow critical pumps to 
continue operation during the transfer. 


An automatic diesel generator startup signal will be initiated on vital bus voltage level of 25% 
as well as in the case of reactor emergency shutdown. 


Within the second and third RBMK generations the diesel generators serving the safety and 
safety related systems meet the single failure criterion. 


Information was provided that strict train segregation within the cabling system could not be 
maintained throughout the plant. Where separation could not be maintained, special features 
have been used, especially for protection against fire. Further clarification of this aspect will 
only be possible during site specific inspection. 


A backfitting program is planned for the first generation of RBMKs. A new building, 
containing three new diesel generators and their associated support systems to supply the 
safety buses will be built. The existing three diesel generators are intended to supply normal 
and safety related systems only. 


In the first generation of RBMK the DC supply is from a single battery and one single 
sectionalized bus, feeding three safety channels. One single failure can disable all safety 
circuits; however, DC supply could be recovered by manual connection to the other units. 


During the discussions of the DC system the experts were informed about the designed battery 
discharge time, which presently is 30 minutes, for all the three generations of RBMKs. 


Battery cell selector switches are used within the 1st generation to maintain DC voltage within 
a specified range. 


RECOMMENDATIONS 


A change for the first generation of RBMKs should be planned with a high priority to increase 
the degree of redundancy of DC buses and batteries. The degree of redundancy of the DC 
system should be in accordance with the existing 3 channels of the 6 kV safety supply system. 
These could be electrically supplied from the three existing alternating current buses. This 
change could probably be co-ordinated with the large backfit plan for new diesel generators 
and power circuits, when it is put into effect. 


When relocating the above mentioned batteries into the new "emergency power supply 
building", no battery cell selector switches shall be used for reliability reasons. Train 
separation shall be maintained from the new equipment in this building down to the safety 
equipment inside the existing plant. 


The designed battery discharge time for all RBMK generations currently is 30 minutes, as in 
other countries in the past. But, meanwhile, it became a standard approach to raise the battery 
discharge time to the order of 1 hour and more to cope with station blackout (simultaneous 
loss of all off-site and diesel generator AC power sources) and accident management 
requirements. The experts therefore recommend the implementation of batteries of higher 
capacities of the order of 1 to 2 hours, based on an analysis of system behaviour under station 
blackout conditions. The priority of this work is dependent on the priority assigned by the 
Accident Mitigation Group. 


The undervoltage criterion for automatic diesel generator startup should be reanalysed (80% 
ofthe nominal voltage is usually used in western plants). An optimization investigation should 
be carried out to avoid frequent diesel startup caused by transient voltage fluctuations of the 
grid. This recommendation falls under the second level of priority. 


Redundant channel separation and protection against common mode failures should be further 
analysed on a site by site basis; this analysis should also be given high priority. 


Further investigation concerning qualification of electrical equipment under harsh 
environmental conditions should be performed. 
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Appendix I 
CORE MONITORING AND CONTROL 
1.1. RADIAL AND AXIAL POWER DENSITY DISTRIBUTION 
Scope of review: Power distribution; 
Allowable peaks; 


Power sharing. 


Document/section reviewed: [1] 


1.1.1. Summary of discussions 


The uncertainties in calculating power distribution in critical experiments on fresh fuel are 5 - 
10%; at full power the uncertainties range from 15% up to 30% (peripheral fuel assemblies (FAs)). 


TABLE Ill. POWER DISTRIBUTION AFTER LOADING 2.4% ENRICHED FUEL 


Reactor Type Comments 


double hump 
skewed towards bottom 


RBMK 1000 


average axial peak | m below mid-plane 
of core 


Smolensk 3 


double hump 
peak above mid-span 
high peak below mid-span 


RBMK 1500 
(Ignalina) 


Note: fa; fax: radial power and axial peak power over average power. 


These values seem to be actual values. 


TABLE IV. MAXIMUM CHANNEL POWER AND LINEAR HEAT RATE FOR DIFFERENT 
PLANTS 


Reactor Type Max. Liuear Heat Rate 


Max. Channel Power 


The calculation concerning the refuelling in the core is done at the plant. The plants are 
responsible for establishing their refuelling plans and the refuelling procedures. 


RBMK 1000 300 W/em all units except Kursk 2,3 


RBMK 1500 400 W/cm 


(Ignalina) 


The calculation is performed using the codes STEPAN in Ignalina, and by the codes OPERA 
for RBMK 1000. 


Another set of calculations is being performed to determine power distributions. These 
calculations are done by the 2-D code BOKR. The results of this calculation are fed into the PRISMA 
code, which is used for the on-line power reconstruction done on the SKALA system. 
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Before the Chernobyl accident the calculation used a database generated for each fuel assembly 
by the WRM code. Now the database is generated using the WIMS code. 


The results of the calculation performed by the SKALA system of the power distribution are 
continuously compared with the power distribution generated on the basis of the in-core detectors. 


The power distribution for the transient analysis is calculated by the RDIPE which also 
performs safety and transient analysis. The transient analysis is performed on a worst case basis 
(conservative initial and boundary conditions). 

Power distribution, reactivity worth of individual control rods and banks, and reactivity 


coefficients determined in experiments are the basis for the comparison with the transient analysis. 
The burnup is taken into account by a special procedure. 


Maximum allowable peak 

For RBMK 1000, the operational limit for the channel power is 2.9 MW. The maximum 
allowable channel power is 3 MW which is also the value used in the safety analysis. Maximum axial 
peak power and channel power are correlated by the formula: 


f x 42/W 


where W is channel power in MW (see Tables III and IV). The maximum axial peak power must not 
exceed the value of 1.7. 


If the operational limit for the channel power is exceeded by 5-10%, the operator gets an 
alarm and is supposed to manually reduce power in the core zone concerned. 


If there are two or more channels outside the allowable limits, the reactor power will be 
decreased manually until the signals disappear. 


Conversion of in-core signals to power 


The individual signals are summed up and normalized. PRISMA results are presented on a 
display and compared with the direct readings. 


For calibration purposes of the in-core detectors, the heat balance of the total plant is used. 


This calibration is performed once a week. Detector burn up is taken into account by specia! 
procedures. 


Power distribution 


During the transition period in going from 2.046 enriched fuel to 2.4% enrichment, a power 
distribution problem had to be overcome. 


Now, with the majority of the fuel assemblies of the higher enrichment, the radial peaking 
problems have been normalized. 


1.1.2. Finding 


1. In case the allowable limit of channel power is exceeded, the operator is supposed to reduce 
power in the channel. If he fails to do so, the local control and protection systems will act. 
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1.1.3. Plant specific status 


Not applicable. 


I.1.4. Recommendations 


1. Efforts to install 3-D methods for the analysis of power distribution as a function of burnup 
should be continued 


2. А 3-D off-line computer program to predict power and burnup distribution should be 
developed. 
3. Methods should be independently assessed in more detail. 


L2. | SUBCRITICALITY OF SHUTDOWN AND UNPOISONED REACTORS 
Document/section reviewed: [1] 
1.2.1. Summary of discussions 

Reactor power control and shutdown is achieved by 211 control rods, 24 of which are part 


of the fast acting scram system (FSS). They provide a total reactivity worth of 2.58. Control rod 
worth is given in Table V. 


TABLE V. ROD WORTH 


Reactivity worth 
cold shutdown, unpoisoned 
(requirement) 


Reactivity worth 
hot shutdown 


Reactor Type 


211 Rods 24 Rods (FSS) 


151 Generation 


2nd Generation 


Each rod on the average has a reactivity worth Ak — 0.18. 


The regulatory requirement for cold shutdown in case of repair with FSS rods withdrawn is 
not less than 40 (2%) instead of formerly 2/8 (1%). 


The "stuck rod" is considered in the calculation. 


The enrichment (2.4% U-235) has a negligible effect on the rod worth according to the 
Russian calculations. 


With partial installation of new control rods into RBMK 1st generation reactors, the cold 
shutdown margin is not less than 38. First requirement: maintain peak to average neutron flux ratio 
« 3.5 under cold conditions. Second requirement: maintain flux ratio « 2.5 under hot conditions with 
rods withdrawn. 
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1.3: CONTROL AND PROTECTION SYSTEM AND THE OPERATING REACTIVITY 
MARGIN 


Document/section reviewed: [1] 
1.3.1. Summary of discussions 

Most of the discussion about control rods was devoted to the methods used for the on-site 
calculations of operative reactivity margin (ORM). Some attention was paid to some exceptional 
reduction of ORM during transition to lower power. 

The relationship between control rod insertion and void coefficient was also considered. 
Finally, the methods used for evaluating the cross-sections in the control rods assemblies were 


discussed. The type and number of control rods in RBMK reactors are given in Table VI. 


The RBMK designers have implemented certain changes to the CPS and ORM for RBMKs. 
Other changes have not yet been implemented. 


TABLE VI. TYPE AND NUMBER OF CONTROL RODS IN RBMK REACTORS 


Unit CR MCR FSS 
(new-design MCR) 

— us n "but 21 
Chernobyl 2 wer aa oup ox pm 
ску 3 a ai БСН БОЛЫ 3m 
Kursk 1 г» wen — | a | m | s | 2 
Kursk 2 ша | a | 2 | s | m 
Kursk 3 a m ааа 24 
Leningrad 1 i a Renee 
Leningrad 2 179 (191) 118 21 (32) 12 (8) 7 (12) 21 
ЕШТЕ 2n 131 24 
Smolensk 1 24 
Smolensk 2 24 

CR = Control rods 

MCR = Manual control rods 

SBR = Short control rods inserted from the bottom of the reactor 

AR = Automatic control rods for controlling the power level 

LAR = Automatic control rods for controlling local power 

FSS = Fast scram system 

C6) = after modification 
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The changes which have been made already (summarized in Table VII) are as follows: 


- Absorber assemblies (AA) are now left permanently in the core. About 80 AAs for RBMK- 
1000 and about 50 for RBMK-1500 are now in place. 


- Modification to present control rod design to prevent the possibility of positive reactivity 
addition when rods move downwards. 


- 8 control rods were changed for 2nd generation RBMKs so that they now enter from the 
bottom of the core. This brings the total of bottom rods from 24 to 32. 


- All bottom rods are now inserted when a scram occurs. 


- The number of effective manual control rods (MCR) for the ORM is now about 45 for 
RBMK-1000 and about 55 for RBMK-1500. 


- The ORM is now calculated every 5 minutes instead of every 15 minutes. 


- The rod insertion time for the control rods is about 12 seconds instead of 19 seconds (more 
than 20,4 in less than 3 seconds from 24 fast acting rods). 


TABLE VII. SUMMARY OF RBMK DESIGN CHANGES TO THE CONTROL 
AND PROTECTION SYSTEM 


Unit Nuniber of Modified Control Number of CR Number of BR Move on 
Absorber Rod (CR) Design of New Design Bottom Rods Scram 


(BR) 


oo 
- 


Chernobyl 1 EN 

Chernobyl 2 о | 

chemoo | o fo | no | vo | 
Kursk 1 о | 

Kursk 2 б eo ol 

Kursk 3 Em 

Kursk 5 | o | 

Leningrad 1 о | БЕ 
Leningrad 2 ЕШ НЫ 
мішыз | o faf m | ve | | 
Leningrad 4 ЕС Н 
Smolensk 1 HW 

Smolensk 2 |o | 

Smolensk 3 


Ignalina 2 


Note: Before and afler refers to Chernobyl accident. 
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TABLE УП. (cont.) 


Unit Control Rod Operating ORM Number of FA, 
Insertion Time Reactivity Calculation 2.4% 
(approx) Margin (ORM) Frequency Enrichment 
(s) (min) 
= 
Chemoby 1 Ce Гаа ET ET o ER ae ЕТЕ mm 
Chery з Pa fies [on foe Pm [ram E mm" 
Kursk 2 Ca Pins [ow Pow |» Ts шш am 979 (ард) 
Kursk 4 EAR ee 1957 Sep) 
мз [ [o | | | | _|лшъ | aamin 
Leningrad 1 [se | зе [wu E [mm | ман 1372 (ug 
Leningrad з К р [к [= 1557 (Au) 
Leningrad a | 18 | моз | >®| виш] so | s | Amin | asmin | 1557 caus 
Smolenski | is | мәз | >z | em | 9 | s | Admin. | Admin | мазар 
Smolensk 2 pe | wore | om [ow | ИЕН ТЕРЕН 1429 (ave 


* it is checked with listing. 
^ it is checked with self-recorder, digital device, display. 


One change to the CPS which is being implemented slowly is the replacement of control rods 
with a new design (it is not considered essential by RBMK specialists to do it promptly since water 
has been removed from the existing rods). Another change, which is an administrative change, is that 
the operator shall make a manual scram if the ORM is violated. 


A typical RBMK design which contains 211 control rods has the rods distributed as shown in 
Table VIII. 


TABLE УШ. DISTRIBUTION OF CONTROL RODS 


z 
Е 

т 

5 


Туре Function 

Manual control 131 Operator controlled - a portion is used to shape power and a portion 
is reserved. 

Local automatic regulation 12 Maintain power shape by using signals from in-core detectors. 


Automatic power regulation Maintain total reactor power by using signals from four lateral 


ionization chambers. Three banks of four rods. 


ә 
A 


Ww — 
t2 


Scram Scram rods - normally withdrawn from core. 


N 


Short absorbing Used to control axial power shape - manually controlled, and enter 


from bottom of reactor. 
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1.3.2. 


1.3.3. 


Findings 


A systematic classification of the control rods with respect to the role (control, protection, 
emergency) and to the moving mechanism (manual, automatic, fast acting scram system) in 
each RBMK-1000 of first and second generation and in the RBMK-1500 was not provided; 
it should be available at all plants concerned. 


Information on the position selected for the 21 redesigned control rods in the RBMK reactors 
of the Ist generation was not sufficient. 


The redesigned control rods will also be implemented in the second generation RBMK. No 
information was provided on the status of implementation. 


Some concern comes from the reactivity effect related to the loss of cooling of control and 
protection system (4-58, in future 2-36): the concern is increased by the fact that only one 
cooling circuit exists. Nevertheless, protection against loss of water is assessed by 3 
parameters, related to pressure in the header, water flow rate and level of water in the upper 
tank, which initiate water makeup to systems with breaks. 


All of the fixes which are made to the CPS and ORM appear to be good and should be in the 
direction of improving the safety of RBMK reactors. Overall, these design changes should 
increase the safety of the reactors in many respects, but it was not evident to the western 
experts that the proposed changes will not reduce the safety margins in other respects. The 
material presented does not include all the details of the analyses used to make this trade-off 
between increased safety and possible reduced safety margins. It is recognized that the RBMK 
reactor is very large, and the chain reaction in one part of the core is only very loosely 
coupled with that in other, distant regions. It is a requirement to control the spatial power 
distribution almost as if there were several independent reactors within the core volume. This 
situation can lead to conditions where small spatial redistributions of reactivity can cause large 
spatial redistributions of the power. The proper assessment of the real trade-off of sometimes 
competing and interactive design fixes requires three-dimensional analyses. 


As seen in Table VIII, a complicated combination of manual control and automatic control is 
utilized to maintain total reactor power, as well as the power shape. The SKALA central 
monitoring system, as well as other instruments, provide the operator with information 
concerning the power level and power shape. The SKALA system provides updated 
information every 5 minutes. The system is designed to provide guidance to the operator for 
steady state control of the power distribution. Under transient conditions, this system would 
be much less effective. 


The SKALA system also calculates the ORM. The ORM is expressed in terms of the number 
of "equivalent" control rods remaining within the core. This definition is not precise, but the 
ORM is very important to safety because of its effect on the void and power coefficients. 

It was also noted that when a violation of the ORM occurs, the operators are only required 


to scram the reactor manually by following an administrative procedure, since this has not 
been implemented into an automatic engineered safety feature. 


Plant specific status 


See Tables VI, VII. 
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1.3.4. Recommendations 


1. Тһе modifications introduced should improve safety, but may lead to possible reductions in 
safety margins. Possible examples are: 


(a) The increase to 2.4% enriched fuel may have a negative effect on power peaking; 
(b) The addition of fixed absorbers may have a negative effect on the shutdown margin. 


Because of the complicated nature of the RBMK reactor physics, an independent assessment 
of these sometimes competing and interactive design changes should be conducted using 3-D 
analyses. Results of 3-D analyses performed by RBMK and western specialists should be 
compared. 


2; Backfitting of additional instrumentation and control devices should be encouraged іп all areas, 
where such additions can be shown to improve safety. Possible examples are: 


(a) In first generation RBMKs, graphite temperature is measured at 24 locations (8 radial 
by 3 axial). In second and third generation RBMKs, graphite temperature is measured 
at 74 locations (6 radial by 5 axial, plus 11 radial by 4 axial). Graphite temperature 
in the remainder of the core is provided by calculation with the SKALA system. A 
possible improvement to safety would be to provide additional instrumentation to 
measure more graphite temperature locations; and 


(b) To increase the computing power of the SKALA system to allow more frequent 
updates to the reactor status than the present five minute interval. Also the 
information provided to the operators in transient conditions in RBMK and relevant 
western plants should be compared. 


3. Due to the importance of the ORM to safety, its violation should be implemented into an 
automatic engineered safety function. High priority should be assigned to ongoing work in 
this area. 

4. The replacement of the ORM concept, which requires too much operator involvement, should 


be further explored. The use of additional and/or improved automatic instrumentation and 
control equipment is suggested. 


I.4. METHODOLOGY AND CODES FOR NEUTRONIC CORE DESIGN 


Document/section reviewed: [1], [2] 


1.4.1. Summary of discussions 


The evaluation scheme used now consists of two main steps. The first is aimed at elaborating 
cross-sections for core calculations. The second step is devoted to core calculations (power 
distribution and reactivity). 


The two groups cross-sections are performed with WIMS D4, the nuclear data are elaborated 


with NIOY from ENDF B 4 and 6 files. The fuel assemblies are calculated for an infinite medium for 
given parameter values such as fuel temperature, water density, graphite temperature, enrichment, 
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xenon concentration. The absorber characteristics are obtained assuming a cylindrical cell with an 
external multiplying zone. These cell evaluations are performed in the Kurchatov Institute, in RDIPE 
and VNIIAES. The validations are made by comparison with Monte Carlo codes MCNP (USA) and 
MCU (Russia). 


The core analysis is carried out in Kurchatov Institute and RDIPE with different tools. The 
core is modeled with 1 mesh per assembly radially and, currently, 16 meshes in an axial direction. 
These codes used the finite differences method. The validation is obtained by comparison with critical 
experiments and plant measurements; for the power density the discrepancies reach 10% and 30% 
respectively. 


On the plants, calculations for the full core are based on 2-D and 2 group diffusion theory; 
the influence of an inserted rod is evaluated with 3-D calculations around the control rod. 


To perform flux reconstruction, the plant calculation scheme used also two groups and 2-D 
codes. 


1.4.2. Plant specific status 


Not applicable. 


I.4.3. Recommendation 


1. Proper core calculations including 3-D tools are recommended to be available directly at the 
plants. Particular attention must be paid to the neutron field calculations near the reflectors. 


L5. REFUELLING PROCEDURE 


Scope of review: Procedure for channel refuelling; 
Change of reactivity; 
Deformation of neutron fields during refuelling; 
Control rod action. 


Document/section reviewed: [1] 
1.5.1. Summary of discussions 


On-power refuelling is carried out at the rate of 1.4 fuel assemblies per day on the 
RBMK-1000 and 1.8 - 2.0 fuel assemblies per day on the RBMK-1500 reactor. Documented 
procedures for channel selection and fuel loading exist and are approved by the chief engineer or his 
deputy in charge of nuclear safety. 


Power distributions in the core are caiculated with a simple 2-D code with a synthesized axial 
distribution (new 3-D codes for fuelling are now being developed). From this power distribution, 
channels for refuelling are selected on the basis of highest burnup and other boundary conditions 
which are documented, but not presented at this meeting. 


The highest burnup channel may not be selected if the neighbouring channel contains fresh 
fuel. The overall strategy is to maintain core symmetry with roughly equal number of control rods 
inserted in each quadrant. The maximum channel power limit for the refuelled channel is 3.0 MW 
with the neighboring channels kept below 2.3 MW. 
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New fuel in a channel causes a local flux/power increase which is compensated initially by 
automatic control rod insertion followed by operator action to insert manual control rods as far as 
possible. Automatic control rods move to compensate for xenon buildup following refuelling. The 
regulators review and approve the procedures used in the refuelling process for each plant. 

Once a channel is selected for refuelling, the old assembly is removed, the flow manually 
readjusted and the new assembly inserted. The flows are adjusted at midlife between fuelling (fuel 
assemblies remain inside typically for 3 years). The critical heat flux margin seems to be between 
1.3 and 1.5. 

1.5.2. Finding 
1. The procedures/practices as described are comparable to those used for on-power refuelling 
in Canada. 


1.5.3. Plant specific status 


Practices as described are applied at all units. 


1.5.4. Recommendations 
1. Development of 3-D code for calculation of power distribution should continue. 


2: Independent review of the documents and procedures referred to by the RBMK specialists 
should be undertaken to confirm the adequacy of procedures. 


I.6. COEFFICIENTS AND EFFECTS OF REACTIVITY 
Document/section reviewed: [1], [2] 
1.6.1. Summary of discussions 
The matter of the discussion was mainly related to methodology for neutronics (see the 
corresponding topic). 
1.6.2. Findings 


1. Complete information on the experimental measurement of reactivity coefficients and, in 
particular, void reactivity coefficients was not available for the review. 


2; Relationship between burnup and void coefficient is important. There were no reports 
presented on this topic at this meeting but RBMK specialists discussed this subject in a paper 
presented at the ТАЕА in April 1992. In an RBMK-1000 using 2.4% enriched fuel with at 
least 80 additional absorbers installed, the discharge burnup is about 20 MW.d/kg U. With 
these conditions the value of the void reactivity is about 0.88. 


3. Information on consideration of the samarium at start up was not available for review; it will 
be discussed at future meetings. 
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1.6.3. Plant specific status 


Not available. 


1.6.4. Recommendations 


1. Measures to allow for calculation of the reactivity coefficients іп any real situation directly on 
plant sites are strongly recommended. 


2, The possibility of void reactivity reduction should be further explored in areas of both design 
and operation (a similar suggestion was made earlier by the Lithuanian regulatory body for 
the Ignalina plant). 


1.7. CORE MONITORING AND SHUTDOWN 


Scope of review: Power monitoring; 
Coolant flow monitoring; 
CPS monitoring; 
Monitoring of other process parameters. 


Document/section reviewed: ІҢ, [2], [3] 
1.7.1. Summary of discussions 


The major part of the discussions was directed at clarifying the material contained in the two 
reports and reconciling that information with the reviewers’ understanding and existing knowledge of 
the RBMK reactors. The major difficulties arose from the significant differences that exist between 
RBMK reactors currently in use. In general it appeared that the monitoring and protection systems 
were much better organized and more comprehensive in scope than was apparent from the prepared 
material. In the discussion it was not often possible owing to time constraints to obtain a detailed 
understanding of the design intent. Two examples of this are given: first, in the case of reactor 
control it was not clear if the plant was expect to follow or try to force the external grid; consequently 
the plant control strategy could not be determined. In the second case, the protection system, it was 
not clear how the action of the shutdown systems, the signal processing and the choice of set points 
related to the safety studies. The safety requirements as referenced in the regulatory documents were 
not known to the reviewers. 


The in-core instrumentation system to monitor power density distribution was discussed along 
with ex-core systems. 


The core coolant flow monitoring system was discussed but no details of the discussion are 
recorded here. 


Instrumentation and the system to measure and display control and scram rod position was 
discussed; no details of the discussion are recorded here. 


Instrumentation to measure general process and thermo-hydraulic core/primary circuit 
parameters (temperature, pressure, flow rate) was covered, but not in depth. No details of the 


discussions are recorded here. 


Reactor power monitoring (neutron flux) was also covered. 
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Control of reactor power and its distribution were discussed in general but power limitation 


depending upon equipment in operation was not covered in detail owing to time constraints. 


Transfer of the reactor core to subcritical conditions and maintenance of subcriticality was not 


covered. 


The scope of the review did not include discussion of the architecture of the control and 


protection systems, the choice of technology or the justification of the reliability of the systems. This 
restriction of the scope was necessary because of the complexity of the systems and the limited time 
available. 


1.7.2. Findings 


Control strategy 


1. 
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The overall strategy adopted for the control of the plant and consequently of the core was not 
clearly stated at the meeting. The consequences of the strategy were that core power output 
was set and maintained and the main coolant flow to the core was held constant. The 
measuring system measured the flux, not the power; however, in all discussions about the 
control systems the two were taken to be identical. All plants use ex-core detectors to control 
bulk power during startup. The local systems are brought into use once the reactor is at or 
above 20% of nominal design power. 


The ex-core detector based bulk power system makes use of ionization chambers at four 
stations around the core to control the axial displacement of a bank of four rods. It was 
established that there may be up to three banks of four rods on a plant, one in use, one in 
reserve and one for use at very low powers, i.e. less than 5% of nominal power. Each bank 
of control rods is associated with a set of a few ex-core ionization chambers. The 
arrangement of the ex-core detectors was found to be plant dependent. The reactors have 24 
channels for ex-core instruments, the detectors operating the 3 banks of rods occupy 12 of the 
stations, the remaining 12 stations being taken up by detectors associated with shut down and 
measurement. The axial arrangement of the ex-core detectors was a single chamber at the 
core mid-plane on RBMK 1000. The channels at Ignalina have chambers at 3 stations, all 
reactors are moving over to this arrangement. It was reported that the ex-core system was 
originally used for core power control on all RBMKs. One of the early ex-core systems is 
in fact still used on the four Kursk reactors. The Kursk arrangement for local power control 
is that the core is divided into 8 segments. The power in each segment is controlled by a 
single control rod and a single ex-core detector. This arrangement would appear to be less 
sensitive to changes than the local control systems using in-core detectors. A second form of 
control system based on ex-core detectors was said to be the secondary control system in the 
Ignalina plant. In this case the control system would appear to comprise two banks of four 
control rods, each bank being controlled by a group of four ex-core detectors. 


Three arrangements of azimuthal and radial power control system using in-core detectors were 
identified as being: seven zone, nine zone and twelve zone control systems. All three systems 
use the output of in-core self-powered detectors to control the adjustment of position of a 
single control rod in each zone. The number of detectors in each zone varied by plant and 
could be two, four or six. The treatment of failed detectors by the control system could not 
be clarified in detail. Equipment condition monitoring was said to be done but the form of 
the monitoring and subsequent action could not be established. 


The control algorithm was found to be that simple rod motion was started when the power 
deviation was larger than 1.0 % and stopped when the deviation fell below 0.95%. There are 


no limits on interzone power differences. However, a range of actions was reported as being 
possible in the event of a large power deviation. For 7% overpower difference between the 
zone power and the set-point, the regulation of power stops. If the difference rises to 10% 
then a power setback was invoked, SS-6, which stops when power deviation goes. The 
operator was said to be responsible for taking action in the event that the power in a zone fell 
out ofrange. The impact of the change from delayed silver emitter to prompt hafnium emitter 
in core detectors on the control algorithm was not discussed. 


The control of the axial power distribution is by operator action using the bottom and top 
entry manual control rods in conjunction with information from the SKALA system and the 
in-core detectors. 


The move to a common 12 zone control system using in-core detector is agreed to be a good 
action; however, the implications of the change on plant currently using other systems as 
reviewed by the RBMK specialists should be examined. 


Monitoring 


7; 


The monitoring of plant parameters and processing of plant information was found to be 
extensive. The SKALA and TITAN computer systems would appear to be very heavily 
loaded and currently have a slow cycle time, e.g. update of flow every 40 seconds and dryout 
margin every 5to 15 minutes. The efforts and actions to accelerate the rate of data processing 
and information updating are supported by the experts. 


Shutdown 


8. 


The main changes since Chernobyl related to the protection functions based upon neutron flux 
measurement. This appears to be because the Chernobyl accident was a neutronics accident 
which appears to have guided much of the backfitting work. The change of manual shutdown 
button from one that had to be manually held down until the plant was shut down to one that 
need only be pressed once is most important. The action to reduce the times for rod insertion 
and the speed with which the reactor is shut down is supported. The tables giving the 
shutdown algorithms in supporting document Shutdown Systems, Ref. [3], require further 
study by the reviewers and the link of the triggering action to the accident transients and to 
the plant safety case must still be made. The approach to proof and periodic testing appeared 
similar to those employed in western plants and the role of such testing when making the very 
strong claims for shutdown system reliability should be further discussed. The development 
of the ASS, additional scram system, with an effective of inserting 26 to 38 in fractions of 
a second was noted. The effect of such a rapid scram on the integrity of the structure arising 
from thermal and hydromechanical shock is worthy of investigation. 


General 


9. 


The division of the control rods of the same function among the six power supplies was seen 
as good practice but there remains the question to what extent this segregation is carried 
through to cable runs and the location of processing equipment. For example it was identified 
that the power and doubling time shutdown instruments were located in the same room on 
Smolensk and Ignalina. This practice differs from that adopted in some other countries. 
There are plans to improve segregation in future systems. 


47 


1.7.3. Plant specific status 


To be expanded, in particular, to identify what detectors, controllers, back up controllers, set- 
points, etc., are in use on what plants. 


1.7.4. Recommendations 


1. More information on the control strategy adopted for RBMK reactors is required. 
2. More information on the protection strategy adopted for RBMK reactors is required. 
3. It is proposed that further work be undertaken to establish the requirements of the plant safety 


case and safety arguments and the links to the protection functions that are and will become 
available on the plant. 


4. In the long term it would be desirable to link the protection function to what it is intended to 
protect and what the protection system has to achieve, e.g. in terms of absorption insertion, 
to provide protection. 


5. The tables of the supporting document Shutdown Systems, Ref.[3], should be expanded and 
it is suggested that the tables are presented in two ways. First, each shutdown mode FSS, SS, 
etc., should be identified, then each case, i.e. set of parameters, which cause that system to 
be invoked should be listed for each of the RBMK reactors. Second, the data could be 
presented as in Table 5 of Ref.[3]. Tables should be expanded to indicate the differences on 
the different reactors and to include all other parameters that cause plant shut down. 


6. It is proposed that a core plan be produced for all reactors showing the location of the fuel, 
different detectors and different control rods. 


7. It is suggested that the implications of the change in azimuthal power control with regard to 
change in detector type and introduction of 12 zone controllers be reviewed. 


8. The impact of the use of the very fast acting ASS on the system integrity needs review to 
ensure that it introduces no unwanted effects. 


9, The data processing computers should be upgraded and additional warning introduced. 


1.8. REACTIVITY ACCIDENTS 


Scope of review: Core behaviour transients for 3 classes of reactivity initiated 
accidents in RBMK reactors. 


Document/section reviewed: [4] 
1.8.1. Summary of discussions 

КВМК specialists presented a brief description of the methods and assumptions used for 
calculating the neutronic dynamic behaviour of the RBMK core for accidents causing reactivity 
addition. These fall into three categories: 

- Changes in reactivity due to significant and abrupt changes in the core coolant density 


(ultimate design base accident-UDBA, false actuation of ECCS, gas ingress from 
ECCS into a fuel channel, etc.); 
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- Changes in reactivity due to the unauthorized withdrawal of CPS rods or under 


refuelling; 
- Changes in reactivity due to water loss in the CPS circuit. 


Accordingly, the discussion focused mainly on three accidents: 


- The UDBA, which is defined as MCP pressure header rupture in one of the reactor 
halves; 

= Control rod withdrawal (since these accidents add reactivity quickly); 

- Loss of water from the CPS. 


In order to model these accidents it is necessary to use 3-D models for the neutronic 
calculations taking into account thermal-hydraulic feedback effects. Since their code validation is not 
complete they calculate the core neutronic behaviour using several codes - TRIADA, STEPAN, TREP 
and RADA - as a means of estimating potential error. Furthermore they have performed a variety 
of measurements at several power reactors and have concluded on the basis of these measurements 
that the codes are sufficiently accurate for all conditions considered. 


The neutronic and thermal hydraulic calculations are necessarily iterative. Тһе neutronic 
distributions for the high power regions of the core are calculated using codes such as RELAP-4 and 
TRANS-8 to determine the voiding rates of the broken portion of the core. Boundary conditions 
applied to the models are conservatively chosen for the accident scenario being studied. The UDBA 
scenario is considered from a variety of initial power levels and from a variety of assumed ORM 
conditions. 


The control rod withdrawal accidents use models employing quarter core symmetry and look 
at withdrawal of every rod. The characteristics of the CPS systems for 7, 9 and 12 zone protective 
systems are consideıed. 


Reactivity additions from CPS cooling circuit failures require detailed calculations since the 
voiding rate depends on the number and position of rods in the core. While the reactivity addition 
is considerably slower than the previous cases considered, the maximum void effect is about 48, which 
exceeds the capability of the FSS. 


1.8.2. Findings 
General 


1. The RBMK reactor, by its characteristics and features, falls into the category of large core 
reactors in which spatially distributed processes are in many cases important to the analysis 
of safety. The dynamics of the reactor are such that local power distortions can result in 
severe consequences unless special monitoring, control and safety systems are provided. It 
is important to note that there have been significant improvements to these systems on RBMK 
reactors since the Chernobyl accident and further improvements will result from full 
implementation of the "Modernization Plan". 


2. Since the Chernobyl accident there have been several modifications which have resulted in a 
reduction of the positive void coefficient and mitigation of its effect on accidents: 


- introduction of approximately 80 additional fixed absorbers; 

- increase in fuel enrichment from 2.0% to 2.4% (currently being introduced on all 
plants except Ignalina); 

- increased ORM and increased minimum ORM; 
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- introduction of 21 to 24 fast acting control rods which constitute the FSS with an 
insertion time of 2.5 s; 

- increase in the number of bottom inserted rods to 32 rods; 

- introduction of new control rod design to eliminate the "positive scram" effect which 
contributed to the Chernobyl accident; 

- increase in speed of insertion of control rods from about 19 s to 12 s. 


The reduced positive void coefficient, in addition to having a direct effect on the consequences 
of the accident scenarios considered below, has resulted in the reactors now having a negative 
power coefficient over their entire power range. 


It should be noted that references to full void effect mean void from full power operating 
conditions rather than from full to empty channel conditions. 


Ultimate design basis accident 


5. 


10. 


12. 
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Using conservative initial conditions such as minimum ORM of 30 rods, fuel enrichment of 
2.0%, fastest channel voiding time, etc., the analysis shows that the resulting void for both 
loops voiding from zero power hot conditions is 2.28. For one loop voiding, the reactivity 
added under emergency shutdown system failure condition is 0.88 (when feedback effects аге 
taken into account) starting from ORM equal to 30 rods at nominal power conditions. The 
corresponding value for both halves of the reactor blowing down has been calculated but was 
not presented at this meeting. These values are lower than the negative reactivity inserted by 
the FSS rods( 2.58) 


The results given in Section 2.2. of this report give a void reactivity coefficient of 1.78. With 
an ORM of 45 rods, the coefficient is 1.28. The actual coefficient has been measured as 0.88 
with the 2.4% enriched fuel which has been added to date. 


The local power pulses resulting from half-core voiding considering only FSS rods with the 
most effective one missing reach values of about 3 times nominal power in the region of the 
FSS rod failure. 


These calculations take into account electronic delays (0.1 s) and actual fast rod drop times 
(2 to 2.5 s) as measured both experimentally and at NPPs. The electronic delay time seems 
small. 


The "standard CPS is capable of providing reliable suppression of neutronic power", limiting 
integral reactor power to 125% of rated power and short term increase in power density in 
the lower part of the core to 60% of the initial value. 


All reactor power levels have been considered in the calculations (even below 20% where 
power operation is forbidden) and the results show power pulses no higher than quoted above. 


The calculation for fuel temperature based on these calculations is less than 1200°C and only 
a very small amount of fission products is released. This result is also dependent on the 
effectiveness of the ECCS, which was not discussed here. 


On the basis of the results presented, there has been a significant improvement in safety 
system performance since the time of the Chernobyl accident. It appears that in general the 
type of calculations presented is similar to those used in the analyses of the CANDU reactor. 
Detailed review of the documents listed as references (but not distributed at the meeting) will 
be necessary to confirm this. The power peaks quoted above are also comparable. 


Rod withdrawal accidents 


13. 


14. 


15. 


16. 


This set of accidents, introduced into safety analysis of the RBMK reactor after the Chernobyl 
accident, considers spontaneous withdrawal of individual control rods. Since these are 
dispersed throughout the core, the need for 3-D neutronics calculations in the consequence 
analysis is obvious. Once the neutronics distribution is calculated, RELAP 4 (now changing 
to RELAP 5-MOD 3) is used to calculate the thermal-hydraulic conditions in the channel of 
interest. 


In order to provide a conservative estimate of the possible consequences of these accidents, 
very conservative starting assumptions are used. It is assumed that two neighbouring channels 
have been refuelled (a violation of fuelling rules), the rods are fully inserted, once the rod 
starts it continues withdrawing to end of travel (mechanical failure of stopping devices) and 
the operator does nothing to stop the rod. 


Rod withdrawal causes a peak in the neutron flux in the vicinity of the withdrawn rod. If this 
type of accident is analysed on the assumption that the control and protection system works, 
then the flux distribution changes due to insertion of other rods in the vicinity. Depending 
on the specific conditions, the flux distribution can actuate either the LSS or the power scram 
system (PSS). The effectiveness of the response of these systems depends upon whether there 
is a 7, 9 or 12 zone control system and where the location of the rod is relative to the 
detectors. In the case of Kursk, there are only ex-core detectors, so coverage will be poorest 
in that reactor. 


The results presented show that for the majority of cases considered, the aims of maintaining 
the cladding temperature below 1200°C and preventing fuel melting are achieved. Only in the 
case of all the above mentioned conservatisms acting together for those reactors with 8 zone 
control systems does very limited fuel melting occur in one channel. Therefore for these 
reactors an administrative procedure has been instituted which requires that the drive 
mechanisms be electrically disconnected when some of the control rods are fully inserted. 
This procedure is followed at Kursk NPP. In order to check the accuracy of the calculational 
methods used, an experiment was conducted, at 50% full power, whereby a rod was 
withdrawn and the nearest zone automatic regulating system was switched off. The results 
showed an increase in power by a factor of 1.6 and the maximum error in the calculated peak 
was approximately 6%. 


The modernization measures planned, which will activate the FSS system from in-core 
detectors, thereby allowing better coverage for rods away from the periphery of the core, will 
further improve the safety of the RBMK reactors for this type of accident. 


CPS cooling circuit failure 


18. 


19. 


Loss of cooling water in the CPS channels will have a distributed and non-uniform effect on 
the core. The specific rate of water loss depends upon the CPS rod design and their position 
in the core since the rate of leakage is governed by how much water is in the channel. The 
rod design and the area of the telescopic tie connecting the absorber and displacer are such 
that simultaneous loss of water in all channels where the telescopes are used leads to a positive 
insertion of reactivity of 48. However, the results of the analysis presented show that 
maximum rate of reactivity addition is 0.125ß/s, which can be handled by the scram system. 


Acceptable results from the analysis of this event are clearly dependent on the accuracy of the 
codes used to predict the rate of discharge of water from the channels. This needs to be 
confirmed from further experiments or ways of physically reducing the rate of reactivity 
addition need to be found. 
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Other accidents 


20. 


1.8.3. 


10. 


11. 
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There was no discussion of accidents involving faulty ECCS initiation, gas ingress from the 
balloon ECCS to the core and group rod withdrawal, except that it was stated that the group 
rod case would be easier to detect and compensate for because of the larger perturbation. 


Plant specific status 


Not applicable. 


Recommendations 


From the reported information it appears that the modifications made to the CPS since the 
Chernobyl accident have resulted in substantial improvements to RBMK safety. The scope 
of the accident analysis has been expanded and some western codes have been introduced in 
calculation of both neutronic and thermal-hydraulic characteristics. However, the margins for 
the UDBA remain tight and uncertainties in the calculation, particularly of the void effect, 
are still significant. With 2.4% enriched fuel and other proposed measures, the margins will 
belarger; however, they have to be compared with typical western margins using common 
methodology. 


Selected results of the safety studies performed and referenced in the supporting 
documentation prepared by RDIPE should be made available for a peer review. 


An integrated review of both the neutronic and thermal-hydraulic studies is needed since there 
is significant interaction between them. 


Independent calculations should be undertaken, using typical safety analysis assumptions 
applicable in other Member States in order to asses the margins which would normally be 
expected using such assumptions. 


Further experiments are needed to understand the blowdown characteristics of the UDBA and 
its effect on reactivity addition. 


Western specialists would like in the future to examine the full scope of the accident analysis 
to ensure that all breaks in piping are covered. Accidents which cause the largest reactivity 
addition are not necessarily the ones which lead to the largest radioactive releases. 


The "modernization" of the CPS should proceed expeditiously since the reported 
improvements would provide considerably better coverage of rod withdrawal accidents and 
for single channel failures when fast response detectors are installed. 


Ways should be sought to increase the effectiveness of fast acting shutoff rods to enhance the 
safety margins for reactivity induced accidents. Àn optimization study is necessary. 


Ways should be examined to reduce the amount of reactivity which can be added during 
failure of the CPS cooling system. 


Further studies should be undertaken to minimize the effect of the ORM on the void 
coefficient. Ideally it would be desirable to remove all restrictions but practically ways should 
be sought to reduce the reliance on administrative procedures in such a critical area. 


The possibility of thermal-hydraulically induced instabilities for the RBMK should be further 
discussed and the interaction with both neutronics and the control system examined for 
possible undesirable effects. 


Appendix II 
PRESSURE BOUNDARY INTEGRITY 


II.1. DESIGN OF THE FUEL CHANNEL 


Scope of review: Fuel channel components; 
Operation of fuelling machine on channels; 
Interaction of graphite with fuel channels; 
Service experience and failures; 
Inspection of fuel channels; 
Hot cell testing of irradiated pressure tubes; 
Replacement of fuel channels. 


Document/section reviewed: [6] 


II.1.1. Summary of discussions 


The fuel channel tubes are made of Zr 2.5 Nb alloy diffusion welded to Ti stabilized stainless 
steel end-pieces. The Zr 2.5 Nb pressure tubes are 80 mm in diameter with 4 mm wall thickness and 
lateral location planes 9 m apart. Provision is made for axial expansion of the tubes relative to the 
lateral location planes, i.e. the upper stainless end-piece is fixed (welded to the structure) while the 
lower end-piece connection allows for axial movement. The related discussion is summarized below. 


RBMK specialists described fuel channel design and continuing efforts to monitor the integrity 
of channels. Some 1600 of the total of 2000 channels are fuelled, with the remaining channels used 
for control rods, cooling graphite and other purposes. The fuel channel schematic drawing is given 
in Fig. 4. 


Three RBMK fuel channels have ruptured due to overheating, which was caused by lack of 
coolant flow. One break was described as 1 m long with a 120 degree opening. There were no 
damage, leaks or breaks of adjacent fuel channels. However, movement of graphite, which resulted 
in deformation of the adjacent channels, was the reason to remove fuel from some of the adjacent 
channels. The pressure tubes concerned were not replaced but fuel channels affected were taken out 
of further service. 


Some 46 fuel channel tubes have leaked in the dissimilar weld region and have subsequently 
been replaced. Leakage was from stress corrosion cracks in the stainless steel section of this weld 
associated with low titanium concentrations. 


RBMK specialists discussed hot cell examinations of material from fuel channel tubes 
removed from service. Measurements have looked at fracture toughness, hydriding, microstructures 
and corrosion. Some 24 channels have been examined, including randomly removed channels and 
others that have leaked or burst. 


Delayed hydride cracking (DHC) has been observed on the outside diameter of fuel channel 
tubes. Growth of DHC has been associated with high residual stresses, induced by the former 
technology of straightening tubes. The technology used at present has overcome this problem (due 
to the resulting lower residual stresses). 


Numerical models of irradiation creep have predicted diametrical growth and closure of the 


gap between the fuel channel tube and the graphite. These calculations have somewhat under 
predicted the rate of gap closure observed in service, owing to the insufficiency of initial data. 
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FIG. 5. Schematic of pressure tube and graphite block arrangement of a fuel channel. 
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FIG. 6. 
fuel channel 47-44. 
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Profile of fuel channel and graphite blocks inner diameter prior to retubing operation, Leningrad 1, 
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FIG. 7. Profile of graphite blocks inner diameter prior to and after refinishing. 
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Replacement of fuel channel tubes is being performed on a routine basis. The Kursk Unit is 
the next station which will require channel replacement. The gap between the graphite inside diameter 
and the channel outside diameter is the criterion for replacement rather than loss of structural integrity 
(see Fig. 5 for the detail of separation between graphite and fuel channel and Fig. 6 for the closure 
of the gap between graphite and fuel channel after about 15 years of service). Postponement of 
replacement would preclude future replacement without damaging the graphite. The graphite blocks 
are bored to enlarge the diameter of the channel passage (Fig. 7 shows the refinished graphite blocks). 


Discussions addressed the possibility of unstable failure of fuel channels and analysis by 
methods using COD (crack opening displacement) parameters and fracture toughness values which are 
obtained from specimens cut from tubes. 


The diffusion bonding of the zirconium to stainless steel was discussed. There has been no 
history of joint failures. 


In-service inspections are performed on fuel channels at all plants using visual, eddy current 
and ultrasonic methods. Leak monitoring has also been effective in indicating the presence of through 
wall cracks. 


Design loads have included startup/shutdown thermal expansion, thermal transients, electric 
power interruption accidents, seismic (on a generic basis) and emergency cool down. The maximum 
design accident is due to rupture of the pressure header (900 mm diameter). 


А 5 х 5 full scale mock-up of cells has been constructed to study the effects of a tube burst 
on adjacent tubes. The actual conduct of the test has been postponed pending action by the Ukrainian 
participants. The facility is in the Ukraine. The facility was built before the dissolution of the Soviet 
Union. 


There was an extended discussion of the refuelling operation and its effect on fuel channels. 
There have been some minor leaks of closure plugs, but no cases where a closure plug has been lost. 
On a few occasions, the refuelling machine itself has had to be used to temporarily seal the end of the 
channel until the unit could be shut down. Seismic qualification of the refuelling machine was the 
subject of a lengthy discussion. 


RBMK specialists confirmed that there was no essential difference among the fuel channels 


of the various RBMK reactors. On the 1500 MW(e) reactor (Ignalina) different heat treatment 
procedures were used for the pressure tubes (for each unit a different heat treatment). 


11.1.2. Findings 


1. Only three incidents of ruptured channels have occurred during operation but no beyond 
design basis accidents have occurred to date (no leaks in adjacent channels). 


2. There have been 73 cases of detectable leakage resulting from through wall cracks smaller 
than critical size, exhibiting leak before break behaviour. 


3. All stations perform inspections of fuel channels using visual, eddy current and ultrasonic 
methods and measure dimensional changes on a regular basis during annual maintenance 
outages. 

4. Tubes are being extracted from reactors for hot cell studies of mechanical properties, 


hydriding, fracture properties, corrosion state and microstructural studies. 
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1.1.3. 


П.1.4. 


П.2. 


In some RBMK units all fuel channels have been replaced because of closure of gaps between 
the tube and graphite due to creep of the tubes and shrinkage of the graphite. The group 
agreed that the study of creep phenomena should be continued. 


The diffusion weld between zirconium and stainless steel was discussed and experience has 
shown this joint to be problem free during thermal cycling of the plant. 


Operation of the refuelling machine was also reviewed in detail, including the methods of 
sealing both the channel closure and the refuelling machine. Seismic qualification of channels 
and the refuelling machine were discussed, and a suggestion was made that seismic 
qualification might be peer reviewed by an IAEA team. 


Plant specific status 


See Table II. 


Recommendations 


Volumetric inspections of the channels would be useful to analyse the development of 
Subcritical cracks. An eddy current type of device carried by the fuelling machine may enable 
this inspection to be done with each fuel change. 


There should be no reduction in the present program of removing tubes and examining them 
in hot cells, determining the physical properties the changes in creep, and the dissolved 
hydrogen, as well as any formation of hydrides. On tube removal the graphite shrinkage 
should be measured and precise methods of gap prediction should be developed on the basis 
of these and the tube measurements. 


The inspection program should incorporate material relationships to identify locations of 
channels with higher probability of stress corrosion cracks. Inspections should then be 
planned on the basis of the results of these predictions. 


The plans to perform tests on the 5 by 5 channel mock-up facility located in the Ukraine 
should be implemented. Attention should be given to the effects of defective tubes adjacent 
to break location. Sufficient instrumentation should be used to enable measurement of all the 
parameters which will allow calibration of the models and validation of the numerical model 
results. 


A program to correct problems with flow control valves at the inlets to the channels should 
be fully implemented. Fail safe characteristics of replacement valves should be fully verified. 
Modifications should be considered to allow non-operator-initiated response to flow 
restrictions. (See also recommendations for the primary circuit.) 


REACTOR COOLANT SYSTEM DESIGN 


Scope of review: Primary circuit; 


Steam and feedwater circuit; 
Emergency core cooling system (partial). 


Document/section reviewed: [7] 
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1.2.1. Summary of discussions 


The discussion was initiated by presentation of a description of the RBMK primary system by 
RBMK specialists. The designers consider the primary circuit to be from the steam drum through the 
pump to the bottom of the channel and then through the channel back to the steam drum. The steam 
separator, however, is a common point with the steam and feedwater circuit and therefore this circuit 
is also reviewed. The presentation was as described in the reference document; of special interest 
however were the following points outlined below. 


The circuit is made of austenitic stainless steel piping and components, or of carbon steel clad 
with austenitic stainless steel, with the exception of some valve bodies which are made of carbon steel 
and the pump bowls which are made of low alloy chromium steel. 


The sources of primary circuit material have been in Russia, France and Japan, and some of 
the separators have been made in Yugoslavia as well as in Russia. The use of steels from different 
sources was not due to any technical considerations but rather to commercial and other considerations. 
Supply from Yugoslavia was as a result of an agreement on industrial technical transfer. 


The steam separator has more than 400 nozzle connections. Some concern was expressed 
about the detail of the nozzle design; a sketch showing how these nozzles are manufactured in such 
large numbers on the stainless steel clad vessel is attached (Figs 8 - 11). The need for this detail was 
reinforced by the fact that on WWER reactors nozzle connections of stainless steel piping to clad 
carbon steel vessels have been of concern. The approach to this type of two material connection was 
to have the transition made at the factory, and to leave a simple stainless to stainless pipe weld for the 
field joint. To date there have been no cases of a connection failure. 


Analysis has shown that the total failure of either the inlet or the outlet tube of the channel 
still allows reliable cooling of the fuel. Partial failures of these tubes and the fluid stagnation is being 
studied by the accident mitigation specialists. 


Some discussion was carried out on the seismic qualification of the channel inlet and outlet 
tubing. These tubes are seismically qualified. Until 1986 the equipment was analysed to common 
seismic characteristics; now seismic parameters are considered on a site specific basis. Site specific 
seismic analysis for Leningrad nuclear power plant is complete while for the other plants the work is 
still in progress. A typical ground level response spectrum is attached to this report to indicate to 
which severity they have been qualified (see Figs 12 and 13). The tubes have also been vibration 
tested and as a result some additional supports have been added. 


A horizontal spacing of 250 mm and a vertical spacing of 90 mm is maintained on the hot 
outlet tubes. 


The pipe whip of the feeder piping was discussed. lt was stated by RBMK specialists that 
calculations indicated that pipe whip forces of a ruptured tube do not rupture adjacent tubes and that 
experiments had shown that the forces may deform tubes but they would not rupture. Similar 
experiments were conducted in Japan and led to the same conclusions. 


In 180 reactor years of operation with about 1600 lines per plant, there have been some 
instances of through wall pipe cracks. Two have been analysed to be vibration induced cracks, others 
were manufacturing or assembly induced effects. The recent (6.10.1992) leak at the Ignalina plant 
at an elbow was due to vibration. The leakage was detected by radiation monitoring. The crack 
length was 12 mm. The crack could not be found after the plant was shut down until a pressure of 
85 kg/cm? was applied. The leakage rate measured on the basis of a known level of activity in the 
water was 300 L/h. There was also a case where cold water dripping onto a hot tube induced a crack. 
This event occurred about ten years ago and the cause for this possibility has been eliminated by the 
addition of a screen between the hot and cold water lines. 
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FIG. 8. | Reactor coolant system nozzles: steam/water line - steam separator. 


Steam Separator 
Steel 22k 


Cladding 
Steel 08Ch18N10T 


Downcomer Pipe 
Steel 08СҺ18М10Т 


Steel 22k 


Buttering 


FIG. 9. Reactor coolant system nozzles: steam separator - downcomer. 
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FIG. 10. Reactor coolant system nozzles: feeder line - pressure header. 


In response to a question as to the occurrence of erosion on elbows, it was confirmed by the 
RBMK specialists that the elbows are monitored for thickness and that to date no thinning has been 
seen on the feed water inlet or outlet piping. 


Inspection of the system is carried out visually, by dye penetrant, radiography and ultrasonic 
methods. Each reactor unit has about 58 km of 68 mm stainless steel piping upstream of the core and 
40 km of similar diameter piping downstream of the core. Each year the piping is visually inspected 
and 5 + 5 (upper and lower parts) welded joints are volumetrically examined. Larger lines and the 
separator vessel are examined every four years. Automatic inspection equipment for headers and other 
larger components is now being developed. The first results obtained by the new automatic equipment 
are compared with the finding of the Finnish specialists for the same components. New imaging 
techniques are being used to display the data. The Leningrad nuclear power plant is being used as 
a pilot plant for this work. Supports of equipment and piping are visually inspected starting after 
15 000 hours of operation and then every 45 000 hours. They are also inspected after any unusual 
transients. 
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FIG. 11. Reactor coolant system nozzles: pressure header - distribution group header. 


In response to a question on the support of the primary system it was established that the 
system is supported as follows: 


- top of fuel channel fixed; 

- outlet 68 mm piping fixed only in transverse direction; 

- steam separator fixed horizontally at centre support and not restrained from upward 
movement; 

- no meaningful differences in support from plant to plant; 

- no problems recorded resulting from the support scheme for the primary system. 


Stress corrosion is controlled by control of the coolant water chemistry. Drains have been 
added to stagnant zones in the circuit to make the water more effective. In the circuit there are 
containers where both stressed and unstressed samples may be placed, exposed to the coolant, and 
later retrieved for study to measure the effectiveness of the water chemistry control. Every 100 000 
hours of operation, samples of material are cut out of the circuit to allow exact study of the situation. 
In the past acid was used for decontamination of the circuit but was found to corrode the carbon steel 
component sections and the practice has been discontinued. The zirconium/2.5% niobium fuel 
channels are protected by autoclaving them to obtain a hard black oxide film. After some time of 
operation some losses of this film have been noted. The causes are not known but they may be 
associated with the fact that the fluid in that section is mainly steam with some water which may cause 
erosion and/or fuel vibration. 
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FIG. 12. A typical ground response spectrum at the foundation level. Soil deformation module 
300-400 kg/cm?, (centre of the base mat). 
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FIG. 13. А typical response spectrum at the reactor foundation. Soil deformation module 300-400 kg/cm’. 
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TABLE IX. STEAM SEPARATORS 
Uait Manufacturer 
Chernobyl 1 2300 22K Izhora 
Chernobyl 2 2300 22K Izhora 
Chernobyl 3 Yugoslavia 
Kur 1 bon 
Kursk 2 22K Izhora 
Kursk 3 2600 Yugoslavia 
Kuk 4 Yugoslavia 
Leningrad | thor 
Leningrad 2 2300 Izhora 
Leningrad 3 2600 22K Izhora 
Leningrad 4 2600 Izhora 
Smolensk 1 Yugoslavia 
Smolensk 2 2600 Yugoslavia 
Smolensk 3 2600 Yugoslavia 
Ignalina 1 2600 Izhora 
Ignalina 2 2600 22K Izhora 
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TABLE X. SUCTION (DIAMETER 900 mm) AND DISCHARGE 
(DIAMETER 900 mm) HEADERS 


=r 

Key: 

1- Steel (22K) and component manufactured at the Izhora plant. 

2- Steel (Creuselso 330 E) manufactured at Creusot, France; component manufactured in the 
former Yugoslavia. 

3- Steel (19ММ5) and semi-products (pipes) manufactured in Japan, component manufactured 
at the Izhora plant. 

А, B, C, D: Different layout of components in the section from the drum separator to the distribution 


group header. 


TABLE XI. CONFIGURATION OF DISTRIBUTION GROUP HEADERS 


Unit Gate valve on the inlet of the Number of distribution 
distribution group header distribution group header group headers 
chemo? | m ye Е 
T " ы 
Kork 2 “ 
Kursk 3 yes yes 44 
ЕТТЕ " БЕКЕН : 
Leningrad 4 yes D tia eel ы 
Smolensk 1 yes yes 44 
Smolensk 2 yes ы 
Smolensk 3 yes yes 44 
шеші | yes n 
Ignalina 2 yes yes 40 


TABLE XII. CONTROL/ISOLATION VALVE ON FUEL CHANNEL INLET 


Key: 

The valves of new design were built in to all plants put into operation from 1987 and onwards. 

1- The new design valve has been installed. Unit is in operation. 

2- The new design valve has been installed. Unit is shut down and being repaired. 

3- Тһе old design valve is installed. The minimum valve opening is two times larger to avoid the recurrence of accidents like 


that in Leningrad 3 in March 1992. The new design valve will be installed in 1993. 
A,B,C- Different layout of components in the section from steam separator to the distribution group header. 


Information on the steam and feedwater circuit was presented by the RBMK specialists. This 
circuit which is made of carbon steel is designed by the station designer (Atomenergoprojekt, except 
Ignalina which was designed by VNIPIET). A rough flow sheet is attached to the report based on the 
Ignalina plant (see Fig. 14 for the first circuit flowsheet, Fig. 3 for the steam circuit flowsheet and 
Fig. 2 for a cross-section of the reactor building). The plant specific details were also discussed (see 
Tables ІХ-ХІ). 


The basic arrangement is that one reactor drives two turbines, each rated at approximately one 
half of the reactor output. All plants have both main steam isolation valves, which close in about two 
minutes, and turbine stop valves which close rapidly (in 0.4 s). There is a series of valves which 
allow about half the steam to be bypassed directly into the condenser. There are also emergency 
bubbler type condensers on the first generation reactors and a suppression pool which uses the same 
principle on the second generation reactors. 


There have been fewer than 10 cases of through wall cracks in the water levelling pipes of the 
steam separators. 
11.2.2. Findings 


1. Тһе main circuit тау һе divided into the part of the circuit which flows through the channels 
and the part of the circuit which flows from the separator to the steam turbine and then 
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11.2.3. 


11.2.4. 


through the feedwater system back to the steam separator. The first circuit interface with 
coolant is mainly stainless steel, although there are some carbon steel valves; the second 
circuit is mainly carbon steel. 


Each feeder pipe has a flow control valve to the channel inlet side and the flow is periodically 
manually adjusted, first when the fuel is replaced and then as the fuel is depleted and the 
contribution of the channel decreases to the reactor energy output. 


Periodic inspections are performed on the bases of specific numbers of operating hours. Some 
of these inspections are visual and their efficiency seems dubious. 


Plant specific status 


The plant specific status is given in Tables IX-XII. 


Recommendations 
The possibility of backfitting better containment-confinement systems should be studied. 


A peer review should be carried out on the reliability analysis of the first and second circuit 
to ensure that the system of valves and the various interconnected safety systems are rational 
and will perform with the appropriate reliability the function for which they have been 
designed. 


Additional safety analysis may be required at the plants where the safety improvements such 
as installation of check valves at distribution headers, etc., have not yet been made. 


The possibility of using motorized valve operators and direct computer control for functions 
such as valve regulation should be investigated. 


The design of the nozzles and joints in the main circulation circuit (in particular those 
containing dissimilar welds) present concerns as to their structural integrity and potential for 
cracking, especially in the latter part of their service life. The connection design should be 
further studied for the effects of ageing and the development both of corrosion cracking and 
carbon steel/stainless steel separation. 


The water chemistry of the reactor and steam circuit is of primary importance since different 
materials are used in the circuit, e.g. carbon steel,stainless steel and zirconium-niobium alloy. 
New methods of decontamination of the circuit should be developed to reduce exposure to the 
in-service inspection personnel without eroding the material of the circuit. 


Site seismic analyses are now in progress or completed for all reactors, and these will augment 
the technical basis provided by the generic analysis. These site specific analyses should be 
peer reviewed, and any indications of equipment or support weaknesses corrected and 
backfitted. Of special interest is the support of the refuelling machine, which should be 
analysed to maintain a condition of remaining locked on to a channel during a seismic event 
without leakage, or any damage to the channel or the machine. 


The system periodic inspection program should be optimized. This is discussed further under 
the subject in Appendix II.3. 


69 


1.3. REACTOR COOLANT SYSTEM INSPECTION 


Scope of review: Methods, scope and frequency of inspection; 
Reliability of inspection methods; 
Laboratory examination of surveillance samples; 
Rejection criteria for degraded material. 


Document/section reviewed: [8] 


11.3.1. Summary of discussions 


RBMK specialists made a presentation to describe inspection programmes (Table XIII) that 
are all guided by a single regulatory document. This document was prepared by the RBMK Design 
Institute and has been adopted by regulatory authorities. Inspections include the following: 


- all the vessel welds of the steam separators excluding penetration welds аге inspected 
once every 4 years by UT; 

- nozzle welds are inspected under other rules, 5 nozzles per separator once every 4 
years; 

- large diameter ferritic piping has all welds inspected by manual UT once every 4 
years; 

- 300 mm stainless piping has welds inspected by radiography; 

- UT calibration is performed on side drilled holes; 

- valves undergo 100% visual inspection; 

- ten elbows of each size of the steam pipe lines are inspected by UT and MT (magnetic 
particle). 


Inspections are performed by plant personnel at each site. Special institute provides training 
and certificates that qualify people. Limited evaluations of performance of field inspectors have been 
conducted by researchers taking samples with artificially induced cracks to check performance of plant 
personnel. 


Inspection optimization has been discussed. RBMK specialists stated that RBMKs lack 
containment and this has motivated 100% inspections of some components. Inspection focusing on 
those components that have the greatest contributions to risk and higher quality NDE on these 
components have been proposed. 


The exposure of metal surveillance samples to reactor environment (radiation and corrosion) 
was discussed. The impact of the examination of these specimens was also discussed. Heat treatments 
of zirconium tubes have been modified based on surveillance trends. 


Inspections of fuel channels in RBMKs, in Canadian CANDU reactors, and in Japan were 
discussed. It was stated that UT inspections in RBMKs were first performed in response to fuel 
channel leakage observed in 1982 (visual inspections being performed prior to that year) and are 
required at all plants by regulation since then. The present status of fuel channels inspection is given 
in Table XIII. The new regulation covering the in-service inspection of fuel channels and control and 
protection system channels, a draft of which is being reviewed, is to be put into force from 1 January 
1993 pending final approval. It specifies the scope and volume of inspection; however, the volume 
is limited to a maximum of 50 of the approximately 1600 channels (Table XIV). In contrast, the 
CANDU pressure tubes are inspected on a 100% sample basis, and 10% of tubes in Japan are 
inspected once every 10 years. 


RBMK channels are now being replaced as needed due to gap closure by creep. Other less 
restrictive replacement criteria are degradation of mechanical properties and deformation of the 
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TABLE ХШ. FUEL CHANNEL INSPECTION (Information on three RBMK units) 


Unit Visual inspection of fuel channels ae a = channel Ultrasonic inspection of fuel Measurement of the graphite hole 
channel diameter 


а әгә GG EI 
aei ЕН БН БИ RE ЙН RE ШЕННЕН ШЕ ЕН RE RR ЖИ ШЕЛ КЕЙП ЕЕЕ 
wc aD ШШ ЛЕ ШЕЕ Е р N ПЕК 
= ee ze 
ШІ ТЕБЕН (sel ЕНІ ЕСЕСІ OO e И 
wn ІР БЕН ЕЕ ЯУ ГЕН ТЕС ИН ЕНІ ПИ КИШ ЧЁ ПИЙ E 
ee er БЕ Р а Е БЕА Е 88 
we ШЕ ПЕШ БЕ ШЙ БЕП ТИШ БЫ ЖЕП БӨ В РЕ ҮН Е а ОЕ qd 
mesi [| БЕ ЕН БЕ БЕНЕН БЕЙ Б ИШ ШЕННЕН ШЕННЕН ШЕ НЕН ШЕП ШИН МЕ 
mies: | БЕНЕН БЕ БЕІН БЕ БИ ИИ БА МЕПЕИ П ШЕНІНЕН Г РЭП ЕН 
МЕСЕ ЕЛЕСІ 


с OSEE ЕЕ ае С 
miei: ЕН БЕН ЕН БЕНЕН ШЕ ЕН ШЕН ЕН ШЕНІНЕН БЕ ИШ Б ПИШ RE ГЕЙ ЕН ШІНШІ 
mei |] LT ЕН БЕІН БЕН ЕНІН ЕНІН ЕНЕ re e 
er [T ЕН БЕ БН БЕІН ЕН ІШ ЕНІН БЕНЕН БЕН ТЕН RE RE DR ИЙ: ER REN 
ee s b E UT URL зей е (же Бк 
emi [| fee 1 see ee LI 
ec ш I ЗЕ ай DD DESEE ES] 


TABLE XIV. VOLUME AND SCOPE OF PROPOSED REGULATION FOR FUEL CHANNEL 
INSPECTION 


Method Number of Fuel Channels Comment 
inspected in given steps 1-4 
IV 
Visual Consequently all channels in this group are tested 
UT Consequently all channels in this group аге tested 


Measurements of: 


- diameter Consequently all channels in this group are tested 


- wall thickness Consequently all channels of this group are tested. 


Thickness assessment 


- Zr2.5Nb tube length Consequentiy all channels of this group are testes. 


Length assessment 


After 20 years of operation inspection volume to 
be reassessed 


- lateral distortion 


Post-reactor hot cell - 1 2 2 - 
examination 


+ Only 15 channels аге inspected if decontamination ofthe main circulation circuit is not performed prior to inspection. 
Step I: During reactor assembly or complete re-tubing. 

Step II: After first 8 000-10000 h of operation of channels. 

Step III: Periodically each 18 000-20000 h during the 15 years of operation of channels. 


Step IV: Periodically each 8 000-10 000 h afler the first 15 years of operation of channels up to reactor retubing or shutdown 
(decommissioning). 


channel. Channels are removed at each plant on a regular basis (beginning at 8000 hours) to permit 
hot cell measurements of mechanical properties. 


Samples of piping materials are exposed to reactor environments in surveillance capsules and 
subject to corrosion and mechanical property tests. Samples have also been cut from actual 
components. Data from the Leningrad plant showed no unexpected changes in properties. 


The joint of steam/water pipes to the steam drum was discussed (see Fig. 8). This is a 
difficult metallurgical joint of carbon steel to stainless steel. Although the configuration of this nozzle 
Joint is not covered by the ASME Pressure Vessel Design Code, it has performed well to date at all 
RBMK plants. 


11.3.2. Findings 

1: RBMK primary circuit piping and components are inspected for defects in accordance with 
a Russian regulatory document. Few if any defects have been found as a result of these 
extensive inspections. 

2. Leak detection has been used to monitor both fuel channels and the primary coolant circuit, 


and the detection methods have been effective in finding leaks in degraded RBMK 
components. 


T2 


11.3.3. 


The RBMK organizations have been developing improved methods for ultrasonic inspection 
of fuel channels and the primary circuit. These methods are slowly being put into practice 
on à pilot basis. 


Non-destructive evaluation of fuel channels by UT or other methods is only now being 


implemented at all plants, and only a small sample of channels will be inspected when it is 
implemented. Leak monitoring will remain the main method of detecting degraded tubes. 


Plant specific status 


Inspections are performed on a uniform basis from plant to plant in accordance with a 


regulatory document. In some cases new inspection technology is applied to specific plants on a pilot 


basis. 


11.3.4. 


Recommendations 


The current program of in-service inspection should be continued as a means to assure and 
maintain confidence in structural integrity. 


Optimization of inspections by identifying the most risk significant locations (probability and 
consequences of failure) is supported. This could lead to fewer inspections, but of a higher 
level of inspection reliability. 


TABLE XV. EQUIPMENT NEEDED TO ENHANCE IN-SERVICE INSPECTION CAPABILITIES 
(As suggested by RBMK Specialists) 


Fuel channels and graphite inspection 


l. 


2. 


3. 


Equipment to record roughness ofthe internal FC surface (replica technique). 

Equipment to remove scraps from the FC inner surface (metallographic analysis). 
Radiation resistant video equipment to record visual examination of FC and graphite stock. 
Radiation resistant endoscope (length 20 m) optical fibre with movable end piece and light. 


Stereoscopic equipment for reactor internal inspection (e.g. following removal FC, ...). 


Leak detection 


2. 


3. 


Manual He leak detectors. 
Radiation resistant optical leak detectors (heat resistant > 1009C). 


Heat resistant humidity sensors. 


LBB application (leak detection capabilities) 


1. 


2. 


3. 


Description of codes and approaches to evaluate related acoustic signals. 
Methods to detect acoustic leak signals within operational noise, evaluation of signals, parameters. 


Methods used to evaluate leak rate based on acoustic signals. 
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10. 


11.4. 


The usefulness of visual inspection of the primary circuit is questionable, except to ensure that 
piping supports are intact. Visual inspections should be augmented by inspections at locations 
of high failure consequences and/or high failure probability, as identified by service 
experience, piping stress analyses and/or other considerations. 


As a long range objective, methods of performing a 100% examination of fuel channels should 
be sought. This will probably require an added capability to the refuelling machine to 
perform inspections at the time refuelling is completed. 


Continued inspections of fuel channels should focus on the diffusion bonded joint between the 
zirconium and stainless steel. These inspections should monitor stress corrosion cracking of 
the stainless portion of this joint. 


The effectiveness of NDE methods should be more extensively established through 
performance demonstrations on specimens with realistic service type defects. These 
demonstrations should have a statistical basis of the type used to guide the PISC programme. 


The nozzle/joining between the feeder tubes (diameter 68 mm) and steam separator should be 
given operator attention. Inspection methods should be improved and demonstrated on 
simulated service cracks on nozzle/joint mock-ups. 


The inspection of the main circulation circuit should be carried out regularly (100% UT every 
4 years). Steam pipes between the separators and the turbine stop valves, and the feedwater 
lines between the separator and the feedwater control valves, should be inspected sufficiently 
to give the same level of confidence as for the primary system, since there are no isolation 
valves between them. 


Improvements on training and personnel qualification for NDE is recommended (ASSET 
missions, comparison of results through international co-operation, etc.). 


The Russian specialists prepared a list of equipment which would improve the in-service 


inspection capabilities (see Table XV). It is recommended that this equipment be acquired as 
soon as possible. 


LEAK BEFORE BREAK CONCEPT 


Scope of review: Leak before break as applied to RBMK reactors; 


Fracture mechanics methods; 

Leak detection methods; 

Numbers and sizes of flaws in welds; 

External events - aircraft impact, wind loads, flooding. 


Document/section reviewed: [9] 


II.4.1. Summary of discussions 


A presentation of fracture mechanics approaches utilized in RBMK reactor analyses was given 


by RBMK specialists. A simplified engineering approach is used since a complete fracture mechanics 
database (in particular J curves) is not available for RBMK primary circuit materials. This strain 
intensity factor concept and limit stress approach has been used to develop tables of allowable flaw 
sizes, which regulate which flaws must be repaired upon discovery during in-service inspection. 
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Probabilistic fracture mechanics calculations have been performed for the 800 mm pipe to 
predict leak and rupture probabilities. Failure of this pıping has the highest consequences should a 
large break occur. 


Data on flaw detection probabilities were presented (by ultrasonic inspection) and data on the 
numbers and sizes of flaws in the welds of 800 mm piping at Ignalina, as well as detected flaws and 
those believed to remain undetected after inspection. In 400 m of weld a total of 2 to 9 flaws are 
believed to exist after UT inspection. Such data have been the basis of fracture mechanics 
calculations, and are a valuable addition to the world database on this subject. 


RBMK specialists stated that the leak before break (LBB) was not the technical basis for major 
RBMK safety concepts, such as containment versus confinement. Analyses of LBB are in a state of 
development and will be used to properly distribute resources (e.g. leak detection versus ultrasonic 
detection of cracks). 
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Leak detection methods at RBMK units were discussed, both for leakage from fuel channels 
into moderator graphite and from piping into compartments. Detection methods are based on acoustic 
signals, radiation levels and humidity (Fig. 15). Leakage from fuel channels is detected for leakages 
of 100 g/h or greater; in other piping, leakages of 50 L/h or greater are said to be detected reliably. 


Evaluations of aircraft impact show that this postulated accident can have severe consequences 
to RBMK units due primarily to fires caused by fuel on board the aircraft. 


Evaluations of severe wind loads are performed on a plant specific basis. 

Flooding from external sources has been considered at individual plants, including seawater 
hazards at Leningrad. 
11.4.2. Findings 


1. The leak before break evaluations are interesting from the viewpoint of fracture mechanics, 
but have no implications yet on conclusions for reactor modifications. 


25 Work is still in progress. Evaluations do not yet prove that the LBB concept applies to the 
RBMK pressure boundary, but future results could prove valuable in properly allocating 
resources. 


II.4.3. Plant specific status 


Leak before break evaluations have been performed on a generic basis, with inspection data 
from Ignalina used to support evaluations. No modifications to plants have yet been made or proposed 
based on LBB evaluations. 


II.4.4. Recommendations 


1. Currently available results related to application of the LBB concept do not provide a basis 
for decisions on RBMK safety. 


2. Provided that the LBB concept is to be applied, plant specific work completed and planned 
should be analysed and peer reviewed, including stress analysis, fracture analysis, stability 
analysis, integrity analysis and leak detection. 


3. Development of the method of analysis for pipe rupture, including zirconium, stainless steel, 
and carbon steel materials, taking into account earthquakes, should be continued. The 
probability studies and data collection should be conducted for each specific equipment layout 
and meaningful plant difference. An expert group should be formed to do this work. 


4. If the leak before break concept is to be applied to RBMK plants, the leak detection system 
should be improved to detect smaller leaks with high reliability and should be properly 
operated. First generation RBMK plants do not have a pressure confinement to endure a pipe 
break for a pipe over 300 mm in diameter. 


5; А peer review should be carried out on the steam line leak detection systems, as well as on 
the safety and isolation valve arrangements. 
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Appendix III 
ACCIDENT MITIGATION 


Ш.1. ECCS DESCRIPTION 


Scope of review: Design of the ECCS Safety Injection for Kursk 1, Smolensk 
3, Ignalina 2 and Leningrad. 


Document/section reviewed: [10], [11] 
Main measures plan to modernize NPPs; 
Ignalina flow diagram; 
Smolensk schemes. 


III.1.1. Summary of discussions 


General 


The safety injection is designed to provide cooling of the reactor in the event of primary 
circuit breaks (inlet cooling) and after the hydroaccumulators have dumped their water into the core. 
The safety injection will also be used to mitigate the consequences of steam line breaks, but this will 
be discussed separately. 


The most limiting pipe breaks for which the system is designed are the following: 


(a) Break of piping or headers of the coolant system in the steam separator compartments, lower 
water lines room, or leaktight compartments. 

(b) Rupture of a distributing group header (DGH), with or without failure of the adjacent check 
valve. 


The maximum diameter of pipe rupture is estimated 300 mm in Kursk 1 (1st generation) and 
900 mm in Smolensk 3 (3rd generation) and Ignalina 2 (2nd generation). 


System description 


The safety injection system (SI) comprises two subsystems with three independent trains of 
a 50% capacity each. The safety injection is designed also for long term heat removal. 


The SI can provide water to all distribution group headers (3 lines to each header). Each line 
discharges to the DGH through a check valve located in close proximity to the DGH. 


Another set of check valves exists in 2nd and 3rd generations or will be added in the line 
connecting all the DGH to prevent the ECCS flow injected to one DGH from passing to the other 
headers. (This flow would otherwise be lost through the *broken' header, increasing the severity of 
the event.) 


A more detailed description of the SI for the three reference plants (Kursk 1, Smolensk 3, 
Ignalina and Leningrad 1 and 2) is provided in the following paragraphs. 
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Kursk 1 


The planned SI consist of two subsystems, each of these divided in three different trains. Тһе 
first subsystem (UCS) provides water to the undamaged half of the primary circuit and the second 
(DCS) to the faulty half of the same circuit. 


Both subsystems take suction from the clean condensate tank (3000 m? capacity). The UCS 
consists of three pumps (250 m?/h maximum capacity) and three independent set of lines to supply 
water to either the left or the right side of the core. The alignment of the three trains of the UCS 
subsystem to one or the other reactor side is made through a set of parallel valves which are closed 
or opened by the initiating signals of the accident. 


The DCS consists of three pumps, different from three of UCS which are located in three 
different lines, which can also provide water to either half of the reactor via the opening and closing 
of parallel valves performed by the accident initiating signals. 


The power supply to each UCS and DCS pump will be provided by a new diesel generator 
(three will be added of 6.2 MW capacity). 


The valves described are electric motor operated valves which can be fed by the corresponding 
emergency diesel generator. 


The water supplied to the damaged circuit will be discharged through the break to the floor 
of the compartment where it is located. From there it will be pumped to the floor drain treatment 
system where it can be cooled and cleaned through an evaporator/condenser and then pumped back 
to the clean condensate tank. The capacity of this system is 40 t/h. 


The steam generated in the undamaged part can be discharged to: 


- main plant condenser; 
- special condenser (fast); 
- atmosphere through safety or relief valves. 


The description of the steam water discharge was provided verbally and is not included in the 
given report. 


The condensed water could be returned to the deaerator or to the clean condensate tank using 
for that purpose the condensate pumps. 


In Kursk NPP three emergency feedwater pumps (EFP) are now installed as the existing safety 
injection. Two more EFP will be implemented as an interim measure before the new UCS and DCS 
are erected. These five EFP will remain as an additional way to supply water to the core. 


No credit is given to the main feedwater pumps to mitigate the accident, although these could 
keep running for about 45 s driven by the turbine rundown. The DBA signal causes the feed valves 
to close (not shown). The cooling of the undamaged core during the short term is provided by natural 
circulation (proven to work in some events). 


In summary the improvements made to the Kursk NPP (SD are the following: 


(a) Addition of six new safety injection pumps and separation of the mechanical circuits which 
provide water to the UCS and DCS; 

(b) Total separation of each 5076 train (except that there is a common source of water); 

(c) Addition of check valves to the lines interconnecting the DGHs to prevent the loss of ECCS 
flow through a broken DGH; 
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(d) Accumulators; 
(e) Increase in the number of EFP from 3 to 5 as an interim measure. 


Construction of a water tank under the reactor to collect water in LOCA conditions to avoid 
reactor system flooding is planned. 


Smolensk 3 
The main differences of the Smolensk 3 SI from the Kursk 1 are the following: 
(a) There are two main sources of water to the ECCS pumps: 


- clean condensate tank (3000 m?); 
- accident localization system pools (suppression pool) (= 3000 m°). 


(b) The UCS pumps (3) take suction from the condensate cleanup tank, and there are 6 DCS 
pumps which take water from the suppression pool. These pumps are associated in three pairs 
constituting for each pair one channel of the SI. It is understood that the capacity of each pair 
is 50% of that required after an accident. Each pair of DCS pumps is fed by one out of three 
diesel generators. Each UCS pumps is also fed by one diesel generator. 


(c) The suppression pool water cooling system takes suction from the lower pool, takes it to a 
heat exchanger (cooled by the service water system) and returns it to the upper pool through 
a system of sprinklers. There are six different loops. Each pair of pumps is fed from a 
different diesel generator. 


The six service water pumps are also fed by these diesel generators. 


(d) There are three emergency feedwater pumps fed by three diesel generators (listed in table 
attached to the document "Use of NPP turbogenerator rundown", and not shown in the 
mechanical figures of Smolensk 3). These pumps constitute another way to provide cooling 
to the core from the deaerator. 


(e) The steam produced in the pressure tubes will be discharged to: 


- Accident localization system (ALS), or 
- Main condenser (if in operation). 


The pipe discharging steam to ALS is not shown in the available diagrams. 


(f) The suppression pool cooling system starts automatically on high pressure in the pool 
compartment coincident with low steam separator level or pressure difference between 
pressure headers and steam separator. The same will happen with the service water system. 


(g) The water discharged through the break to rooms which are not part of the ALS is taken by 
the floor drain system and treated and cooled in ап evaporator and condenser and then 
pumped back to the deaerator or to the suppression pool. This system is not shown in the 
drawings provided, but this information was provided verbally. 


(h) The correct functioning of ECCS in case of the DGH break depends upon the correct 
operation of about 30 check valves, which are not testable during operation. 
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Ignalina 1 


The SI of this plant is quite like that of Smolensk 3, except for the following: 


(a) There are no UCS pumps; however, six emergency feedwater pumps are available each 
supplied by a different diesel generator. 

(b) 7000 т? of water can be supplied from the chemical treatment plant (desalination system) to 
the clean condensate tank. 

(c) The water needed to cool the damaged side of the core is 750 t/h in the first period after the 
accident. In addition, 150 t/h are needed to cool the undamaged side. 

Leningrad 
Referring to Fig. 16 (related to Leningrad 1 and 2): 

(a) Emergency cooling systems valves (4) are normally closed; they open to provide flow into the 
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broken loop through ECCS headers and distributing group headers. There are three 
interconnected ECCS headers in each primary loop that provide water to each distributing 
group header of that loop. 


1. Emergency water tank 11. Distribution group header 

2. Emergency feed water pumps 12. ECCS header 

3. Throttling unit 13. EFP suction header 

4. ECCS 14. MCP 

5. Emergency feedwater supply system 15. EFP pressure header 

6. Water chemical treatment facility 16. From main condensate system 
7. Low-capacity electric feed pumps 17. Core flooding with sea water 
8. Electric feed pump pressure header 18. To second reactor part 

9. MCP suction header 19. From deaerator 

10. MCP pressure header 20. Steam separator 


FIG. 16. Emergency water supply system. 


(b) The emergency cooling system (3 pumps) has the unique function to inject water in the broken 
loop; the residual heat from the core accumulates in the confinement system and can be 
removed by non-safety-grade systems (drainage to chemical treatment facility, not connected 
to diesel generators). 


(с) Іп case of ОВА (break of 300 mm equivalent diameter) 2 pumps are needed to cope with the 
accident. If an additional single failure is assumed in one distributing group header check 
valve, all three pumps are needed. 


(d) The equipment needed to refill the emergency feed pump tank (from chemical treatment 
facility or liquid waste storage system, etc.) is safety grade and its active components are 
served by reliable auxiliary systems (e.g. emergency diesel generators). 


(е) Тһе pipe that provides injection to the ECCS header is single and is normally pressurized 
(limited flow passes through ECCS headers in normal conditions). A break in this pipe either 
causes primary fluid loss or prevents ECCS injection. During an accident, manual actions are 
needed in the very short term to line up the system to cool the fuel. 


(f) The time elapsed from DBA occurrence and diesel generator startup and alignment on ECCS 
pumps motors is designed to avoid exceeding the fuel limiting condition (accumulators are not 
required for DBA break of 300 mm diameter). 


(g) During DBA the emergency feedwater supply system (2 pumps) takes suction from deaerators 
(balance of plant) and injects water in two steam drums. The water circulates in the 
unaffected half of the core (intact loop) owing to the driving force of the system pumps and 
to natural circulation (the main circulating pumps trip when the low capacity electric pumps 
are started). If the main condenser (and/or the turbine) is available, the steam produced is 
condensed and the loop is closed (normal automatic control systems regulate separators level). 
If the main condenser is not available, the steam is condensed in an "emergency condenser" 
cooled by auxiliary systems (safety grade, connectable to the emergency diesel generators). 
In this case the deaerators have to be refilled in the long term by the chemical treatment 
facility. 


(h) The emergency feedwater supply system valves (5) in the quoted figure are actuated when the 
water has to be injected in the ECCS header. 


(i) One low capacity electric feed pump is needed to cope with the accident in the case of DBA. 


ECCS accumulators and fast acting valves 


The ECCS accumulators and fast acting valves act as a high pressure emergency cooling 
supply for the damaged side of the reactor. They supply cooling to the damaged side of the reactor 
until the ECCS pumps are operational and able to supply cooling. 


The fast acting valves (Figs 17 and 18) are electric motor operated gate valves. These valves 
are powered by a ‘reliable power source’ whose ultimate backup is battery power. These valves go 
from full close to full open in 10 seconds and are open sufficiently to allow injection of cooling water 
into the core within ~ 3 seconds. 


These valves will normally operate with approximately 25 atm of pressure differential across 
them. They are tested and timed annually with this pressure differential. Note: it was pointed out 
by an RBMK specialist that these valves have also successfully operated with a much higher pressure 
differential. 
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1. Reactor 12. Intercept float valve 

2. Steam separator 13. Intercept fast acting valve 

3. MCP 14. Section of intermediate throttling 

4. МСР pressure header 15. ECCS fast acting valve 

5. ECCS bypass 16. Pumps for undamaged core side cooling 
6. ECCS header (UCSCP) 

7. DGH 17. Pumps for damaged core side cooling 
8. ECCS flow limiter (DCSCP) 

9. DGH limiting insert 18. Clean condensate tank 

10. Electric feed pumps 19. Long term cooling subsystem valve 
11. ECCS storage unit 20. Gas supply 


FIG. 17. Upgraded ECCS of RBMK 1000 (Ist stage of construction). 


There are three of these fast acting valves for each channel or division. One is located on the 
collection header downstream of the accumulators supplying that division; this valve is normally open 
and is designed to close when the accumulators are drained of water. The closure of this valve is 
based on the level in the accumulator (for Smolensk 3 it is based on level or time). 


The other two valves are located downstream of flow control valves and are normally closed. 
One valve supplies water to one side of the reactor and the other valve supplies water to the opposite 
side of the reactor. During an accident ће ECCS actuation logic determines which side of the reactor 
is *damaged', based on the pressure in the leaktight rooms, and opens only the fast acting valves 
which supply water to the ‘damaged’ side of the reactor; the fast acting valves which supply water to 
the undamaged side of the reactor will remain closed. 


The undamaged side of the reactor is cooled by the normal cooling system (main circulation 
circuit) until the ECCS pumps start supplying flow. The flow is maintained by the momentum (inertia 
or rundown) of the main coolant pumps. 


The flow control valves (Figs 17 and 18) for each division consists of two normally open 
valves in series and restricted flow bypass line around these two valves. These valves are designed 
to close after about 40 seconds (Ignalina). This allows full flow out of the accumulators for the first 
~ 40 seconds and then reduces the flow. This extends the time that the accumulators can supply 
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water to the reactor to about a total of 2 minutes. The reason the time is extended is to assure 
sufficient time for the emergency diesel generators to start and then for the ECCS pumps to start and 
come up to speed and pressure. The power supply for these valves is the same reliable power supply 
that powers the fast acting valves. 


The accumulators (Figs 17 and 18) are basically a high pressure storage tank containing water 
which is then pressurized by a cover gas (nitrogen). Since there is no physical barrier between the 
water and cover gas, there is a ‘float’ valve located at the outlet of the accumulator which should close 
when the water is drained and thus prevent the cover gas from entering the ECCS piping. 


It was stated that experimental tests have shown that this float valve is not affected by the flow 
of vortices generated in the accumulator when the fast acting valve opens. It was pointed out that 
there had been a problem with this valve ‘sinking’ - but a level indication has been added and the level 
of the float valves is monitored. 


It was also stated that there have been no problems in these tests with the closure of the float 
valve. However, it was pointed out that after it closes it sometimes took considerable effort to reopen 
it. 


1. Reactor 13. Intercept fast acting valve 

2. Steam separator 14. Section of intermediate throttling 

3. MCP 15. ECCS fast acting valve 

4. MCP pressure header 16. ALS condensing facility tank 

5. ECCS bypass 17. Pumps for damaged core side cooling 
6. ECCS header (DCSCP) 

7. DGH 18. Clean condensate tank 

8. ECCS limiting insert 19. Pumps for undamaged core side cooling 
9. DGH limiting insert (UCSCP) 

10. Electric feed pumps 20. Long term cooling subsystem valve 
11. ECCS storage unit 21. Gas supply 


12. Intercept float valve 


FIG. 18. Upgraded ECCS of RBMK 1000 (2nd stage of construction). 
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The capacity of the accumulators varies from unit to unit. At Ignalina the total capacity of 
the accumulators is 200 m°. At Smolensk 3 and the 2nd generation units the total capacity is 150 m°. 
The 1st generation units that have accumulators currently have a capacity of 40 m? and all Ist 
generation units are being upgraded with new accumulators with a total capacity of 225 m°. 


It should be noted that for some units, only 2 of the 3 ECCS divisions have the accumulators 
and fast acting valves. For these units the other division utilizes flow directly from the feedwater 
pump discharge header (2nd generation units and Ignalina). The modified or upgraded ECCS for the 
ist generation units (at least at Kursk) have the fast acting valves and accumulators for all three 
divisions. 


During our discussions it was noted that there is no reservoir for the nitrogen cover gas; each 
accumulator is instrumented for pressure. 


Testing 


Provisions for tests are not shown on the report diagrams; however, it has been stated that 
during maintenance (at least twice a year) all active components, instruments and their logic channels 
are tested. A system functional test is also performed at these outages. 


Physical hazards to main 81 components 


Insufficient information is provided on physical hazards to main ST components. It has been 
generally stated that there is no risk of flooding of ECCS electric components since the drainage 
system has been adequately designed to cope with any pipe failure in each compartment. 


It was also stated that all ECCS electric and I&C equipment is environmentally qualified to 
perform its function in a harsh environment after an accident. 


Protection against the dynamic effects from hazards associated with the breaks of high energy 
pipelines has not been defined in detail when considering ECCS design. It was, however, generally 
stated that such a protection exists, and it was agreed to check this item on a plant by plant basis. 


1.1.2. Findings 


1. The proposed addition of check valves adjacent to the distribution group headers (DGH) for 
plants of the 1st generation was made on the basis of limiting the discharge of water through 
the broken DGH coming from the remaining DGH. In this sense the improvement is found 
acceptable. 


2. It is recognized that these valves are necessary in order for the ЕСС$ to successfully cool all 
fuel channels during some accident scenario. However, it still must be evaluated whether 
under different (and possibly more likely) scenarios, failure of one or more of these valves 
could prevent adequate cooling to many fuel channels. 


3; The drain system of Ist generation will be upgraded to have additional capacity to cope with 
flooding in the rooms below the reactor. A new tank will be added to the drain system. To 
increase this capacity is considered good; however, the basis for limiting this improvement 
to only this room needs to be examined. The flooding analysis of all rooms which contain high 
or moderate energy pipelines could be a basic input to determine all the areas where some 
modification in the drain system could be needed. 
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Prevention of flooding in rooms with redundant equipment (ECCS pumps, etc.) could be an 
important measure for the operation of the ECCS system. 


Some supporting systems to ECCS (1st generation RBMKs before reconstruction) have been 
found necessary. These systems were not designed as safety related systems (regarding power 
supply, material choice, manufacturing quality, degree of redundancy, etc.). They are, for 
example, the recirculation of condensed steam to the condensate tank, the drain floor system 
and recirculation to clean condensate tank (including evaporator, pumps, etc.) or to the ALS 
pools, the provision of water from the desalination plant, etc. These systems differ from plant 
to plant. 


ECCS upgrades - addition of ECCS pumps and piping for the 1st generation RBMKs will 
provide some redundancy and increase the capacity of the ECCS. However, there was 
insufficient information relative to whether these upgrades will increase the capacity of the 
ECCS sufficiently to handle the full spectrum of accidents including a break of the largest 
diameter pipe. 


Among the planned improvement measures (Table D), there is the installation of additional 
water tanks in Kursk 1 NPP. This modification is intended to increase the volume of water 
available for ECCS injection in the long term. 


Addition of the number and capacity of the ECCS accumulators will improve the redundancy 
and capacity of this early injection portion of the ECCS. However, there was insufficient 
information on whether this increase in capacity will provide sufficient cooling capacity to 
handle the full spectrum of accidents, including a break of the largest diameter pipe. 


Plant specific status 


The plant specific status is discussed in Section III. 1.1. 


Recommendations 


It should be investigated from the test and performance history of check valves adjacent to 
DGH how much such incorporation could be an initiator of abnormal events in the primary 
circuit owing to their failure. 


Should the result of this investigation be positive (i.e. no significant increase in circuit failure 
rate is expected), then it is strongly recommended to instal these valves as a first measure on 
plants of the 1st generation. 


Testability of these valves should be improved, designing them to be testable during normal 
operation. 


An acceptable leak rate though the valves should be defined taking into account the hypotheses 
made in the accident analyses. The associated actions, should this value be exceeded, need 
to be specified (decrease power, plant shutdown in a certain time, etc.). 


A more detailed analysis should be provided, including probabilities of the effect for various 
accident scenarios both with and without the check valves. 


The addition of a new drain water collecting tank is found appropriate as a partial measure. 
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7. A flooding hazard analysis of rooms with safety equipment should be performed, to determine 
the expected flooding level and to ensure that the safety equipment operation is not threatened 
by it. 

8. Adequate physical separation of safety equipment is necessary to prevent common mode 
failure due to flooding if needed. 

9. RBMK specialists should make additional analyses of the drainage system and other systems 
used for long term cooling in order to assess their impact on accident sequences. 

10. If the drainage system is required to operate after an accident, it should be upgraded as a 
safety related system (emergency power supply to pump, quality of material and design, tests 
of equipment, etc.). 

11. The need for further improvement in the drainage system should be determined. 

12. Perform plant specific analyses to determine the systems and components needed to support 
the ECCS operation after a design basis accident. 

13. Specify upgrading measures for these systems or justify that the core could be cooled without 
using them. 

14. Implement the measures with a priority correlated with their safety importance. 

15. Ап independent review of the outcome of these analyses is recommended. 

16. Proceed with the planned Ist phase (interim) upgrade for the Ist generation RBMKs of 
increasing the number of EFP from 3 to 5, and ECCS lines from 1 to 2. 

17. Proceed as soon as possible with the 2nd phase of upgrading the ECCS for the Ist generation 
RBMKs by installing the additional ECCS pumps (3 for damaged core side cooling - DCS, 
and 3 for undamaged core side cooling -UCS) and associated diesel generators. 

18. A more detailed analysis should be provided showing the specific deficiencies of the original 
design and how the upgrades remedy those deficiencies. 

19. The planned installation of additional water tanks in Ist generation units can improve the 
capabilities of the plant to cope with large break failures. Therefore, it is recommended to 
proceed with the above modification. 

20. The planned upgrade to increase the number and capacity of ECCS accumulators at the 1st 
generation RBMKs should be proceeded with. 

21. A more detailed specific analysis related to ECCS accumulators should be provided, showing 
the specific deficiencies of the original design and how the upgrade will mitigate the 
deficiencies. 

Ш.2. ECCS STARTUP LOGIC 

Scope of review: Correct understanding of the logic of ECCS operation during some 


main accidents. 


Document/section reviewed: [10] 
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Ш.2.1. Summary of discussions 


Pipe ruptures in the most reinforced reactor buildings compartments (leaktight compartments 
of the second generation reactor units) cause "liquid" leaks that more rapidly discharge the primary 
water inventory and less effectively reduce the primary system pressure (the specific behaviour 
depends on the break size). These breaks have a high potential to cause fuel cladding and/or channel 
tube failures. 


(A) If the break takes place in the downcomer part of water lines coming from the steam separator 
(SD), up to the first check valve, the SD of the affected loop will experience a level drop. 


Under the conditions of the downcomer rupture in the reinforced leaktight compartment the 
ECCS will actuate as follows: the signal of pressure increase is generated initially in the affected 
compartment (set point 200 kgf/cm?) which is a symptom of the pipeline rupture (a symptom of 
leakage) and a signal for SS-5 actuation, and then in about 15 s the signal of level decrease in drum 
separator (-1000 mm) of the failed half up to emergency setpoint is generated. This signal is the basis 
of identification of damaged circuit half by logic "AND" operation circuit. 


(B) Under the conditions of the pipeline rupture downstream of the MCP check valve, the ECCS 
system will actuate when the signal of pressure increase in the affected compartment (which is also 
the signal of SS-5 actuation) and the signal of pressure difference decrease between the MCP pressure 
header and steam separator drum will coincide in time, since under such a rupture this signal will be 
generated considerably earlier than the signal of level decrease in the steam separators. 


The logic described will actuate the emergency cooling by opening the fast acting isolation 
valves of all channels of the early injection portion of the ECCS (accumulators; all RBMK units except 
Leningrad 1 and 2) to feed water to the damaged half of the reactor only. 


At Leningrad 1 and 2 (1st generation RBMKs) opening of the fast acting isolation valves and 
the startup of the emergency feed pumps or low capacity feed pumps (electric) is accompanied by 
closing of valves to prevent water from being fed to the steam separators of the damaged half of the 
reactor. 


The early injection subsystem of the ECCS is designed to provide the emergency cooling for 
the first two minutes after the accident. Following that, the subsystem of long term cooling of both 
damaged and undamaged halves of the reactor starts up. 


(C) Pipe ruptures in steam separators rooms or ruptures of feedwater lines coming from steam 
separator up to the first check valve can cause steam leakages (steam lines), water leakages 
(downcomers and feedwater lines) or mixed water and steam leakages (risers). For the downcomers 
and feedwater line breaks, the same logic of paragraph A applies. 


In case of steam line breaks, no automatic emergency cooling actuation is envisaged if the leak 
is inside the control capabilities of normal plant (level/pressure) control systems (a fast scram takes 
place as a consequence of high confinement room pressure). 


If the leak exceeds the control capabilities of control systems, an automatic steam line isolation 
signal takes place and/or a turbine isolation control valve closure signal takes place, (at a pressure 
setpoint value of 59 kgf/cm? in one SD one turbine group is isolated; at a setpoint value of 54 kgf/cm? 
in the SD, the remaining turbine group is also isolated) possibly followed by an automatic power 
reduction or SS-5 (shutdown after a trip of both turbine generators of the unit). 


For small to medium breaks upstream of the turbine control/isolation valves (energy loss from 
the break less than the energy produced by the affected half core), after the steam lines are isolated 
the pressure of the loop stays high, the safety valves may cycle and the level in the drum separator 
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drops to scram/emergency cooling actuation setpoint of case A above. (The actual behaviour depends 
on the control/isolation logic). A similar behaviour is envisaged for steam breaks downstream of the 
turbine control/isolation valves. 


For large steam breaks upstream of the turbine control/isolation valves (energy loss from the 
break higher than the energy produced by the affected half core), the pressure decrease in the drum 
separator (down to 42 kgf/cm’) or the high decrease rate (signal implemented in most plants) in ап 
"and" logic with MCPs trip, associated with low flow (5000 m?/h) through any pump, actuates 
emergency cooling in both primary loops. 


The actuation of ECCS on both primary loops is due to the fact that such large ruptures have 
certainly seriously unbalanced the steam systems of both turbogenerator groups. In both cases above 
the steam is freely discharged to the affected building area. 


(D) When the reactor is in shutdown condition, with the steam dumped to the main condenser and 
condenser water returned to the reactor, the pressure in the drum separator has to be maintained in 
the range 37-74 atm. If the pressure exceeds maximum limit, a signal is generated to open main 
steam line safety relief valves. If one or two of these valves fail to close after opening, the ECCS will 
start on the coincidence of a pressure rise signal in the dump line downstream of the valves with either 
of the following two signals: 


- pressure in the SD lower than 42 kgf/cm’; 
- flow rate decrease in any main coolant pumps down to 5000 m?/h, given a previous 
pumps trip. 


The above described logics A, B, C unless differently specified will actuate the emergency 
cooling in the broken loop and disable the actuation in the unaffected loop. 


The actuation of the intact loop cooling will take place only if normal feedwater system is no 
longer able to carry out its normal operation or if the main turbine/condenser will no longer be 
available. 


The signals to actuate emergency cooling (low capacity feed pumps or undamaged circuit 
pumps depending on the plant generation) are normal feedwater pumps trips in coincidence of low SD 
level (200 mm below the separator axis in a 1/4 logic) and low pressure in the feedwater pressure 
header (76 bar in a 2 out of 3 logic). 


Ш.2.2. Findings 


1. А comprehensive understanding of the emergency cooling systems actuation logic depends 
strongly on the availability of detailed logic diagrams for each plant generation and of: 


- main coolant pumps trip logic; 
- isolation system trip logic; 
- main cycle control system trip logic. 


2: In Table I improvements on signals which are part of the scram logic are included. In 
Ref. [12] a recommendation for beyond DBA is included that addresses the use of independent 
group sensors for actuation of different safety functions (scram and emergency cooling). No 
diversification of physical parameters seems to be envisaged for initiation signals of 
emergency core cooling systems, often in "and" logic. 
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11.2.3, Plant specific status 


The logic generally applies to plants of all three generations. Differences could be found in 
set-point values and in the details of implementation. 


III.2.4. Recommendation 


1. Іп going towards a signal modification in protection system logic, it is recommended to plan 
a wider programme of systematic review to implement other effective changes, including: 


- diversification of signal for ECCS startup; 


- improvement of the diversification of sensors that actuate different safety functions, 
also from the point of view of beyond DBA protection. 


III.3. SEPARATION 


Scope of review: Understand the functions of the ECCS and confinement 
system. 

Document/section reviewed: [10], [11], [12], [13] 

11.3.1. Summary of discussions 


Following is a very brief description of the degree to which the various channels or divisions 
of ECCS and confinement system components are isolated or separated from the components in other 
divisions. This item has not been discussed very much and was not mentioned in the supporting 
documents that were provided, so there is very little detail. 


There is at least some recognition for the need to separate the various ECCS and confinement 
system divisions. For example, the piping for the various ECCS divisions contains check valves when 
lines from different divisions are connected to common headers (the distributions group header for 
example). The three ECCS divisions each have their own separate piping systems with the only 
common points being the water supply (the water storage tanks are indicated to be interconnected) and 
the connection to the main circulation circuit. 


It is not clear whether this piping is physically separated (i.e. in separate rooms). It is also 
not clear whether the pumps, accumulators and fast acting valves are physically separated from those 
components of the other divisions. It was stated that in some parts of the plant there is separation, but 
not in others. There was no specific design intent concerning separation. 


The emergency diesel generators are located in separate rooms; however, there was no intent 
to separate the electrical cables. The exception is Smolensk 3 and to a lesser degree the Ignalina units 
where separation was considered to some extent during the design. 


Note: The electrical separation issue is also addressed in Appendix IV. 


ПІ.3.2. Finding 


1. The RBMK design has not provided for full physical separation of the ECCS components and 
equipment for one division or channel from the equipment and components of another 
division. There was insufficient information provided to ensure that components from 
multiple divisions would not be adversely affected by a common event (fire, flood, falling 
equipment or debris, etc.). 
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11.3.3. Plant specific status 


As indicated above. 


111.3.4. Recommendations 


1. More detailed analysis of how the equipment is adequately protected from common events 
(common mode failure) should be provided. 


2. If item 1 above cannot be done, specific fixes that will provide adequate protection against 
common mode failures (i.e. improved fire protection, shielding, etc.) should be identified. 


3. Plant specific missions should be carried out to investigate this topic. 


Ш.4. ECCS PERFORMANCE CRITERIA 
Document/section reviewed: [10] 
III.4.1. Summary of discussions 


The following criteria were presented as those which indicate acceptable ECCS performance 
during all design basis accidents: 


- the fuel element cladding temperature should not exceed 1200°C; 

- the local depth of fuel element cladding oxidation should not exceed 18% of the 
original wall thickness; and 

- the amount of oxidized zirconium in the core should not exceed 196 of the original 
mass of zirconium in the fuel sheaths in the core. 


ПІ.4.2. Findings 


1. The use of the 1200°C maximum cladding temperature criterion for a channel type reactor 
such as the RBMK may be overly restrictive. The criterion was derived by the USNRC for 
pressurized and boiling water reactor designs. 


2: In the RBMK design two 18 element, 3.5 m long fuel bundles are located inside each Zr 2.5 
Nb pressure tube (30 mm in diameter with a4 mm wall thickness) which in turn is surrounded 
by graphite block (250 mm x 250 mm). Under normal operating conditions the maximum 
graphite temperature remains less than 700°C. The presence of large quantities of graphite 
(1700 tonnes) provides a potential heat sink for overheated fuel and a physical barrier between 
the fuel bundles. 


III.4.3. Plant specific status 


Not applicable. 


111.4.4. Recommendation 

1. Safety experts for channel reactors, PWRs and BWRs should meet to review whether the use 
of PWR/BWR ECCS performance criteria in the safety assessment of a channel type reactor 
such as an RBMK is technically appropriate. 
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11.5. SELECTION OF LOSS OF COOLANT DESIGN BASIS ACCIDENTS 


Document/section reviewed: [11] 


11.5.1. Summary of discussions 


All pipe breaks, analysed as design basis accidents, whether fuel channel, distribution group 
header or pressure header, are considered to be guillotine failures with double ended discharge. 
Partial pipe breaks are considered to be highly improbable in that any partial break capable of heat 
removal deterioration has a size exceeding the critical, so it is assumed to result in guillotine double 
ended pipe failure. 


The probabilities of the various sizes of pipe breaks are stated to range from 1.2x10° 
Occurrences per reactor year for fuel channels to approximately 10* occurrences per reactor year for 
the rupture of a pressure header with failure of the check valve on one distribution group header. 


There are many valves present in the heat transport system. As an example there is a 
control/isolation valve associated with each fuel channel, a check valve and a stop gate valve 
associated with each distribution group header, and check and throttling and stop gate valves in the 
piping associated with each main circulating pump. 


11.5.2. Findings 


1. Partial breaks, of a size that may ог may not be stable, could result in periods of flow 
stagnation in one or more fuel channels. These periods of channel flow stagnation could result 
in cladding temperatures in excess of those quoted in the referenced DBA analysis for 
RBMKs. 


2. The probabilities of pipe failures cited in the RBMK reports are considerably lower than those 
presently in use in the safety analysis of other reactor designs. Also failure of one or more 
valves in the heat transport system could result in an additional range of break discharges from 
the heat transport system. 


11.5.3. Plant specific status 


Applicable to all RBMK units. 


111.5.4. Recommendations 


1. Fuel and fuel channel transient thermal/mechanical behaviour апа consequent fission product 
release should be assessed over the entire range of break sizes for all the various pipes and 
headers in the heat transport system. Although potential breaks of a significant size may not 
be stable, the assessment of such partial breaks, and designing safety systems to adequately 
cope with the predicted consequences of the entire break spectrum (including partial breaks), 
is necessary according to the internationally accepted "defence іп depth" philosophy. 


2; The technical basis for the pipe break probabilities cited in the RBMK experts' reports should 
be rationalized with the conservative failure probabilities assumed in the safety assessment of 


other reactor designs. 
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3. The potential for valve failures and/or failure of the welds/connections associated with valve 
installation should be assessed. The range of failure modes and failure probabilities for the 
valves within the heat transport system should be studied in detail. 


4. Channel reactor, PWR and BWR technical safety specialists should have further discussions 


with the RBMK safety specialists to rationalize the definition of loss of coolant design basis 
accidents for RBMKs. 


Ш.6. LOSS OF COOLANT ACCIDENT ANALYSIS 


Scope of review: ECCS; 

Containment/confinement system. 
Document/section reviewed: [10], [11], [12], [13] 
It.6.1. Summary of discussions 


The analysis of the loss of coolant accident (LOCA) is traditionally one of the accident 
analyses used to confirm the effectiveness of the shutdown, emergency core cooling and 
containment/confinement systems. This part focuses on the latter two systems only, as the shutdown 
system effectiveness is addressed in Appendix I. 


In general, one should acknowledge the various recommended design improvements to the 
safety systems. These include the improvements to the emergency core cooling system (ECCS), to 
the confinement system (eg. the steam dump pipes to protect the reactor cavity from overpressure) and 
to the reduction of positive void reactivity. With respect to LOCA analysis, computer codes with an 
apparently sound technical basis are used to perform the analyses. Furthermore, a beyond design basis 
LOCA is also analysed for the purpose of accident management planning. The defence in depth 
approach is also evident, with the primary emphasis on prevention, followed by mitigation and the 
. protection of the multiple physical barriers against the release of radioactive materials. 


11.6.2. Findings 


There are a number of subject areas needing further technical information. This is not 
unexpected owing to the limited review time and the summary like nature of the documents provided. 
It should be cautioned that definitive conclusions should not be drawn without having reviewed the 
clarifying technical information. 


1. The design basis LOCA considered in Ref. [2] to be the worst is the rupture of the pressure 
header with the failure to close of check valve of one distribution group header (DGH), 
although it is acknowledged in the same reference that partial pressure header rupture could 
yield worse consequences, possibly owing to potential core channel flow stagnation. 
However, one could envisage other LOCA accidents such as steamline failure posing other 
unique problems, because in the absence of a main steam isolation valve, there could be 
irrecoverable loss of coolant inventory and unmonitored release of radioactive materials. A 
pipe/header rupture together with a seismic event could also pose its special problems if some 
of the mitigating systems are not adequately seismically qualified. Therefore, in order to 
ensure that the worst design basis LOCA is identified for a particular nuclear power plant, a 
systematic review of the plant should be carried out, including but not limited to a survey of 
the critical pipe/header break size and location. 


2. It should be noticed that RBMK specialists believe that partial pressure header ruptures are 
highly improbable since crack sizes are greater than the critical crack size. 
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Ш.6.3. 


Ш.6.4. 


1. 


То demonstrate that ECCS equipment and confinement components will not be disabled by 
cross-link effects in the short as well as in the long term still needs to be justified. Cross-link 
effects include environmental effects such as flooding, condensation, temperature, pressure 
and radiation, or dynamic effects such as water hammer, pipe whip and fluid jets. 


The extent to which ECCS and confinement equipment are seismically qualified has not been 
mentioned in Refs [10-13]. It is particularly important for equipment which is required for 
long term operation, such as the water and power supplies for long term ECCS operation and 
the system for confining the radioactive releases. 


Only limited information was available on the exact configuration of the ECCS and its credited 
mission time. During the discussion, it appears that long term ECCS could utilize the liquid 
waste management system, use the leakage collection system as a long term recovery system 
or draw water from the sea/lake as a once-through system. It is important to identify clearly 
the essential water and power supplies for long term ECCS operation. 


The many probability and reliability claims in Refs [10-13] require a review of reliability 
analysis and applicability of data. 


Only limited information was available on the following: 
(a) airborne and possibly waterborne leakage of radioactive materials from areas such as 
confinement compartment envelope, safety relief valves, ECCS equipment, 


particularly long term ECCS equipment; 


(b) assumptions on radioactive releases, such as fission product distribution, washout, 
plateout and charcoal filter efficiency; 


(c) assumptions for exposure calculations such as weather scenarios, location and 
exposure time duration of the most exposed individual. 


For the computer codes used in the LOCA analysis, assessment of the following is still 
required: 


(a) the physics, mathematical models, empirical correlations and simplifying assumptions; 
(b) validation, including benchmarking against standard or analytical problems, 


comparison against pertinent experimental data and actual RBMK transients during 
commissioning and operation and ‘blind’ testing against relevant test data. 


Plant specific status 


Not applicable. 


Recommendations 


An independent review of the studies carried out by RBMK specialists in order to identify the 
worst design basis LOCA should be organized. (See also Appendix III. 1.) 
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2. Separate reviews in the form of specialist meetings should be held to clarify the following 
subject areas: 


(a) cross-link damage; 

(b) reliability analysis; 

(с) radioactive release calculation; 

(d) computer code documentation and validation standards; 
(e) human factor engineering and operator models. 


It is further recommended that sufficient documentation should be prepared and made available 
to the specialists prior to the meetings. 


3, The exact long term configuration of the ECCS and its credited mission time should be 
presented for review. 


4. Further technical information should be presented and independently reviewed on the 


reliability assessment for the gas system used to maintain an inert environment around the 
graphite in a RBMK reactor. 


Ш.7. ACCIDENT MITIGATION 


Scope of review: Beyond design basis accident. 
Document/section reviewed: [12] 
III.7.1. Summary of discussions 


The discussions began with a "reading" of the respective report (Ref. [11]). Major discussions 
and questions involved the information in Table 3 of Ref. [11]. This table is part of a PSA level 1 
study carried out for Leningrad 1. An attempt was made during the meeting to review this report. 
However, this review was not within the planned scope of the meeting and it was difficult for RBMK 
specialists to fully respond to some specific questions. The numerical values of Table 3, Ref. [11] 
were not clarified at the meeting and therefore they could not be used as a technical basis and 
justification for decisions on RBMK safety. 


There was considerable clarification provided relative to the functioning of the ECCS. 


In addition, the discussions provided considerably more information on how all the various 
"Recommendations" are being handled. The following information was provided: 


- There is an "overall plan" that is reviewed and updated routinely - for example, the 
ECCS beyond DBA analysis was a specific line item on the "overall plan". IAEA 
asked for a copy of this "overall plan". 

- The utilities are responsible for evaluating the benefit of the recommendations and 
whether to implement them or not (there is also some input from the regulatory 
authorities concerned). 

- All modifications/upgrades must be reviewed against the safety analysis. The 
modification package along with this review must be reviewed and approved by the 
regulatory body prior to performing any modifications. 


Ш.7.2. Findings 
1. In order to cope with beyond design basis accidents, a recommendation has been focused by 


plant designers to design and install an independent source of water supply to the primary 
circuit. The purpose is to provide long term cooling in case of failure of all systems. 
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2. Among the proposed improvement measures identified in Table I, there is a modification in 
this area applicable to each considered plant. 


3. It has been proposed to provide an independent line for water supply from external sources 
(lake, etc.) in all plants considered. 


4. No detailed information has been made available about the requirements applicable to this 
additional equipments. 


5. The technical basis and justification for the numerical values of Table 3, Ref. [11] were not 
available. 
11.7.3. Plant specific status 


As far as independent water sources are concerned, the first generation units (Kursk) already 
have diverse water sources (service water connection and artesian wells); the other generations still 
do not have these features implemented, (Table I). 


II1.7.4. Recommendations 


1. The possible availability of large amounts of water can improve the long term plant response 
to specific scenarios in which either active components fail or water sources are exhausted. 


2; The planned actions have the potential to considerably increase safety along the lines followed 
in other countries. 


3. The design implementation should take into account: 


- interfaces with other systems and with layout restraints; 

- interfaces with operator teams in the reference design conditions; 

- the need to develop, in parallel, suitable accident management procedures for the 
above reference conditions. 


4. A peer review ofthe Leningrad 1 PSA level 1 is necessary to justify results given in Table 3, 
Ref. [11] prior to use of these results in support of safety decisions. The IAEA should 
undertake this review with the help of consultants if requested by the relevant Russian 
institutes. 


Ш.8. CONFINEMENT SYSTEM 


Scope of review: Confinement system of Smolensk 3. 
Document/section reviewed: [13] 
11.8.1. Summary of discussions 


Only a part of the primary circuit is enclosed in an accident localization system. This system 
consists of more or less leaktight compartments. All main pipelines, headers and components carrying 
subcooled water are part of the accident localization system (ALS). There are two major parts of 
rooms of the ALS: the compartment system of the rooms below and to the side of the reactor cavity 
in which the inlet pipelines to the technological channels and the groups distribution headers are 
located (24 100 m?, 0.1 m?/h leakage, 0.8 kgf/cm? design overpressure) and the compartments system 
where the main coolant pumps and the suction and pressure headers are located (19 500 т?, 0.6 m?/h 
leakage, 4.4 kgf/cm? design overpressure). The tightness is measured once every four years. 
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1. Reactor cavity protection system against 8. Condensation facility 


excess pressure 9. Sprinklers 
2. Main circulation circuit piping room 10. Cooling system 
3. Air ejector 11. Pump 
4. Reactor cavity 12. Heat exchanger 
5. Relief valve 13. Steam distribution corridor 
6. Condenser 14. Two storey pressure suppression pool 
7. MCP room 


FIG. 19. Schematic diagram of the accident localization system. 


The (civil engineering) design overpressure of the pressure compartment system amounts (0 
4.4 kgf/cm? whereas the calculated pressure at the maximum design basis accident (rupture of a header 
of 900 mm in diameter) is given by 3.5 kgf/cm? (absolute). 


The reactor cavity (Fig. 19), the main coolant pumps (MCP) and main header rooms, the 
lower water line rooms and the steam distribution corridor are connected to a pressure suppression 
pool system by 236 steam dumping channels (total cross-sectional area: 50 m?) immersed in its water 
space. 


The pressure suppression system consists of two floors of concrete compartments with steel 
liners. The water level is 1.2 m in each compartment. The total water volume, which is also the ECCS 
water, equals 3200 m? whereas the free space of the pressure suppression pool is 3700 m’. 


In addition to a system of valves between the compartments of the pressure suppression 
system, the localization equipment includes also a sprinkler system with pumps and heat exchangers 


and surface condensers in the steam distribution corridor between the MCP compartments. 


The rooms where the steam-water lines, the drum separators and upper parts of the 
downcomers are located are not included in the accident localization system. These rooms are in 
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connection with the main reactor hall by an unsealed area of about 5 m?. The argumentation of the 
designer is that these compartments were not included in the ALS because ruptures of tubes here are 
of little radiological impact, when no previous fuel cladding failures have occurred. It is assumed that 
leakages and ruptures of primary pipelines in these rooms can be coped with by the ventilation system 
and its special filter system. In addition, the ventilation system feeds into the stack system with its 
own filter system. The motors of this ventilation system are connected to the reliable power supply 
system. Heat exchangers are supposed to cope with the released energy from the primary system. 
The steam-air mixture is drained to the purification system. According to the presentations, the design 
leak in this part of the primary circuit with reference to the compartment system is the rupture of a 
pipeline of 300 mm in diameter. 


To protect the steam separator/reactor hall compartment system from over-pressurization, 
safety relief flaps are installed which open at an absolute pressure of 1.015 kgf/m? (= 1.015 bar) to 
the atmosphere. 


11.8.2. Findings 


1. Тһе defence іп depth concept is not consequently applied to the rooms in which the steam- 
water part of the primary circuit is located. This holds also for the reactor hall. 


2; However, investigations regarding the strengthening of the reactor building structure, 
including the roof of the reactor hall, are being discussed by the RBMK specialists including 
the installation of a leaktight compartment system for these rooms (steam drum separator 
rooms, steam/water pipeline rooms, central reactor hall). Thus an additional barrier for a part 
of the primary circuit could be established in conformance with international practice as well 
as with the defence in depth concept. 


11.8.3. Plant specific status 


No units of the Ist generation of RBMKs have confinement and pressure suppression systems 
similar to those of plants of the 2nd and 3га generation, but separate buildings for pressure 
suppression systems are in discussion for these units. 


01.8.4. Recommendations 


1. Тһе decision to create a pressure suppression system for 1st generation units which is similar 
in its design efficiency to those of the units of the 2па and 3га generation is supported. Since 
these devices were not foreseen in the original design, the construction of a separate building 
seems to be an appropriate way. 


2. It is recommended to upgrade the upper rooms (reactor hall, steam separator rooms) with 
respect to leaktightness and confinement function in order to have an additional barrier in 
accordance with the defence in depth concept. 


3. It is suggested that the discharge from these rooms in the event of a major break in the 
primary system within these compartments could be directed into the pressure suppression 
system or to a filtered ventilation. 


4, A stress analysis and a seismic analysis should be performed before the reconstruction of these 
rooms. 
5. In accordance with international practice and in application of the defence in depth concept 


to the confinement function, consideration should be given to the installation of steamline 
isolation valves (see also Appendix III.4.) 
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Ш.9. REACTOR CAVITY OVERPRESSURE PROTECTION SYSTEM 


Scope of review: Brief description of the functions of this system for first and 
second generation RBMK plant design, plus descriptions of 
Russian plans for improvements and status. 


Document/section reviewed: [10], [13] 
IIT.9.1. Summary of discussions 


The purpose of this system is to avoid pressure increase in the enclosed, sealed core region 
of the reactor (denoted "reactor cavity" by the RBMK specialists), which might otherwise cause 
damage to the boundary of the sealed space. In particular, the greatest concern is the lifting of the 
upper biological shield/head structure as occurred during the Chernobyl accident. According to 
information in Ref. [13], this places an upper limit of 3.1 atm absolute pressure in the cavity. 


The source of pressurization is postulated to be failure of a process channel inside the cavity 
region. Such a failure would result in expansion of a steam-water mixture into the confines of the 
cavity. To mitigate pressure buildup, there are a total of eight 300 mm emergency steam discharge 
pipes, four venting from the space above the graphite stack and four venting from below it. The 
steam discharge pipes connect to systems designed for steam condensation. 


The design basis for the cavity overpressure protection system is the failure of one process 
channel. The design of the discharge-condensation system is based on conservative assumptions on 
steam-water blowdown for the single tube failure; that is, a complete guillotine break with double 
ended flow. Factors such as flow resistance due to the moderator and shield block stacking and the 
presence of fuel assemblies inside the channel were ignored in the design basis analyses for 
conservatism. 


The overpressure protection system is different in the first and second generation RBMK 
designs (i.e., without and with pressure suppression pools, respectively). In the first generation 
plants, the discharged steam is condensed in a heat exchanger, and non-condensable gas enters a 
holdup tank before being released to the building stack via the gas cleanup system. In the second 
generation plants, the discharged steam is piped to separate zones of the bubbler-condenser pool where 
it is condensed. The bottom of the pipes are submerged approx. 2 m in the pool, so there is a 2 m 
water seal between the cavity and the pool which must be exceeded in order to initiate steam 
discharge. 


Information in Ref. [10] indicates that the actual capacity of the steam discharge-condenser 
systems actually exceeds the design basis of one channel failure. The analyses were based on not 
exceeding an ultimate pressure of 3.1 atm in the cavity. On this basis, the actual existing capacity is 
said to be two tube failures for first generation plants (Leningrad 1 and 2; Kursk 1 and 2; and 
Chernobyl 1 and 2) and 3 tube ruptures for second generation plants. Smolensk 3 was constructed 
with improvements already in the design and can accommodate nine simultaneous tube ruptures. The 
analysis methodology was the same as described for the design basis accident. 


Improvements to the reactor cavity overpressure protection system are planned for all units 
(except Smolensk 3) and have been initiated at some units. These improvements are intended to 
increase the number of simultaneous tube failures that can be accommodated without exceeding the 
ultimate pressure limit of 3.1 atm within the cavity. There were no technical requirements given as 
the basis for the improvements, and the DBA for this system remains a single channel failure. The 
intent of the improvements is to make the safety margin as large as reasonably achievable. 


The first stage of improvement is to add two atmospheric relief valves and pipelines 
connecting to existing steam discharge pipes at the top region of the reactor. Each relief pipeline is 
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400 mm in diameter and terminates in a special valve. The valve is said to have a calibrated 
aluminum rod which ties the valve cap to its seat. The design pressure to fail the calibrated rod is said 
to be 2.8 atm, 0.3 atm below ultimate allowed pressure. When the rod fails the cap is lifted, and 
blowdown of the gas/steam mixture to atmosphere ensues. It was stated that the valve cap would 
return to its seat by its own weight when the pressure is reduced, but that pressure level is not known. 
There is no requirement that the valve would reseal upon closing. The valve is said to have a very 
reliable opening pressure, although it is not possible to test or verify as installed. 


This first stage of improvement was said to increase the accommodation of simultaneous 
process tube ruptures by one or two. Specifically it was said that for Smolensk 2 this upgrade will 
be made during the next shutdown which will increase the number of simultaneous ruptures 
withstandable to four (from three currently). This improvement is planned for all units. It was said 
that this upgrade has already been completed at Leningrad 1 and Chernobyl 1 and 3 and is under way 
at Kursk 2. 


The second stage of improvement is to add an additional 600 mm diameter steam discharge 
pipe in the upper region of the reactor. According to information presented, this new vent capacity 
will be extended to the pressure suppression pool system for the second generation units. This pipe 
also is dedicated to the atmospheric vent function. Two 400 mm diameter pipes are connected to the 
top (T joints) of this new steam discharge pipe so that the same atmospheric relief valves described 
above will also be used on this new pipeline. The total number of simultaneous process tube ruptures 
is said to increase to nine for all units when both stages of improvement are taken into account. 


Some consideration had been made to the environmental impact from possible direct releases. 
Briefly it was said that the consequences were acceptably small since only very limited fuel failures 
were foreseen. 


An additional major improvement was mentioned pertaining to the first generation units. 
There is a plan for an additional stage of improvement involving construction of new pressure 
suppression pools in new sealed buildings. The atmospheric discharge pipelines would be routed to 
this sealed space for steam condensation, thereby eliminating the need for the atmospheric vents. This 
seems to be at the proposal stage and does not appear to be scheduled at any of the units. 


In general, the capacity of the overpressure protection system is being re-evaluated taking into 
account actual experience at Leningrad NPP. The extreme conservative analysis approach taken now 
in the rating may be relaxed on the basis of this experience. It can be expected that the rating in terms 
of simultaneous tube failures will be increased in the future on this basis. 


11.9.2. Findings 


1. The RBMK specialists conclude, on the basis of their DBA analyses, that there are no 
sequences that result in multiple tube failures inside the reactor cavity. This is a very 
important conclusion for this type of reactor owing to the serious consequences of 
overpressurizing this cavity. This conclusion needs to be peer reviewed. The types of 
accident sequences analysed and the results of those analyses need to be subjected to peer 
review and audit calculations. 


2. Owing to the fact that there is no design basis for multiple tube ruptures, it has not been 
possible to assess the merits of the improvements described for the cavity overprotection 
system. These improvements, after implementation of all stages, will provide conservatively 
based capacity for nine simultaneous tube ruptures. 


3, The first stage of improvement, which involves the addition of two atmospheric vent valves 
connected to existing steam discharge pipes, was said to add a one or two tube failure vent 
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11.9.3. 


capacity to the current capacity of two or three tube ruptures. This amounts to a very small 
incremental gain and raises the question of the net benefit, in view of the fact that it is 
achieved by opening the cavity space to the atmosphere and the inherent uncertainties in valve 
opening and closing characteristics. 


The second stage of improvement, which involves addition of a new 600 mm steam discharge 
pipe from the cavity to the condenser pool, plus two additional atmospheric dump valves, was 
said to result in a total capacity of nine tube ruptures. 


The atmospheric vent valves are said to open very accurately at 2.8 atm absolute pressure 
compared to the maximum safe pressure of 3.1 atm in the cavity. The consultants have 
concerns about the functioning of the valve, i.e. what is the uncertainty in the range of 
opening pressure with the calibrated rod installed in the assembly; can it be reliably assured 
that it will reclose after venting, will it reseal after opening? This cannot be functionally 
tested in situ. 


There is a proposal for an additional major improvement which would obviate the need for 
atmosphere venting; that is, the construction of separate sealed buildings containing water 
pools for the steam discharge pipes entering them. 


Plant specific status 


The plant specific status is given in Table XVI. 


TABLE XVI. REACTOR OVERPRESSURE PROTECTION 


Unit 


Improvements Current Overpressure 


2 stage Relief Capacity 


Leningrad 1 Completed 4 tubes 
Leningrad 2 > 


Kursk 1 


Kursk 2 


2 
е 


Chernobyl 1,3 Completed Not planned* 4 
Smolensk 3 Completed Completed 9 
Other uis з 


10.9.4. 
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Capacity following completion of improvement, unit restart. 
Not currently planned for Chernobyl owing to uncertainty of continued operation. 


Recommendations 


The measures being taken to increase the safety margin of the cavity overpressure protection 
system were recognized. However, the solution of uncontrolled venting of the cavity space 
to the atmosphere was questioned. The recommendation is to encourage the technical solution 
of greater capacity by the fast condensation in pressure suppression pools in leaktight areas 
already proposed, as exists in Smolensk 3. 


A topical specialists meeting should be organized to review the design basis for the reactor 
cavity overpressure protection system concerning multiple tube failures, review in detail the 


technical solutions, and assess the adequacy of both the design basis, the technical solutions, 
and the best estimate protection capability measures. To accomplish this: 


(a) Recommendations for specific accident sequences to be analysed should be compiled 
in advance of the meeting. This could focus on those sequences thought to be most 
likely to challenge pressure tube integrity involving multiple tubes. The meeting 
should focus on RBMK presentations of results of requested analyses as well as 
selected audit calculations from the international community. Clearly the interest is 
to confirm the position of the RBMK specialist that multiple tube ruptures do not 
occur. This is regarded as high priority and should be scheduled for early action. 


(b) The meeting should include the topic of pressure tube integrity, including the response 
of pipe and pipe welds to the rapid transient conditions of accident sequences. 


(с) The RBMK specialists should provide information about the specifications of 
improvements including requirements, technical solutions, drawings, testing and 
experience. It should be clear what is implemented and planned at the various units. 


(d) The RBMK specialists should provide assessment of best estimate overpressure 
protection capacity based on experience as well as the capacity based on conservative 
analysis methodology. 


111.10. HYDROGEN CONTROL 
III.10.1. Summary of discussions 


One of the subsystems of the accident localization system is designed to remove the non- 
condensable gases including hydrogen. This is shown as item 3, air ejector, on Fig. 19. 


III.10.2. Findings 


1. This system consists of 3 subsystems, two of which are іп operation, and the third is a spare. 
One subsystem serves the leaktight rooms, and the other serves the under reactor rooms. 
Each of these subsystems contains two blowers, hydrogen detectors and hydrogen 
recombiners. 


2. The non-condensable gases are drawn out of the various rooms or chambers and directed 
through charcoal filters before being released out the stack. When the hydrogen concentration 


exceeds the set-point, an alarm is activated in the control room. An operator must then start 
the hydrogen recombiner. 


III.10.3. Plant specific status 


Not applicable. 


ПІ.10.4. Recommendation 


1. Ап unacceptable concentration of hydrogen could be present іп the confinement zones, 
especially following severe accidents. For accident mitigation and accident planning, it is 
recommended that an automatic hydrogen control and mitigation system should be designed 
and installed. 
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Ш.11. CONTAINMENT TESTING 
III.11.1. Summary of discussion 


The general rules for nuclear plant safety provisions regulating the RBMKs state that for 
localization systems, commissioning tests with regard to pressure and tightness capability should be 
carried out at design pressure. The rules also state that periodic tests should be made after the plant 
has been taken into operation. 


It was said by the RBMK specialists that such commissioning tests had been performed on all 
RBMK reactors with the exception of the two units at Ignalina. There the tests had, for reasons not 
explained, been performed at substantially lower pressure levels than design. 


Ш.11.2. Finding 


1. Commissioning tests made only at low pressure leave uncertainties with regard to the integrity 
and the leakage rate characteristics in case of pressurization for the Ignalina localization 
systems. 


Ш.11.3. Plant specific status 


Not applicable. 


ПІ.11.4. Recommendation 


1. The situation with regard to pressure capacity and leaktightness for Ignalina localization 
systems should be explained and justified. 


Ш.12. MAIN STEAMLINE FAILURES 


III.12.1. Summary of discussion 


In this accident scenario, a guillotine rupture of a 600 mm diameter steam pipe is postulated, 
resulting in rapid depressurization of the main reactor cooling circuit. Assumption of a coincidental 
station blackout further exacerbates the accident scenario. When the cooling circuit pressure drops 
to 38 bar, circulation stops and emergency core coolant injection is required for both parts of the 
reactor cooling circuit. The ECCS actuation signals and logic is depicted in Fig. 6 of Ref. [10]. 
Steam pipe ruptures inside as well as outside tight rooms are assessed. In the first case, reactor scram 
(SS-5) is initiated by either increased pressure in the leaktight room or loss of electric power, whereas 
in the second case, reactor scram is initiated by trip or unloading of both turbines. 


During such a postulated transient at Smolensk 3, the rate of steam discharge is calculated by 
the CRITICA code, accounting for critical steam discharge where necessary. Due to the presence 
of special nozzles, the initial discharge rate at 100% is limited to 1920 kg/s. Since electrical power 
is assumed lost, all main and feed pumps stop. The main circuit pressure drops rapidly to 43 bar in 
40 seconds during which cooling is provided by pump rundown; thereafter, the reactor is cooled by 
the ECCS and fuel cladding integrity is maintained. Reactor power decrease monotonically following 
fast shutdown in 2 seconds. In-core voiding occurs in 6 seconds. Steam discharge terminates in 
approximately 2 hours when the system pressure reaches atmospheric level. About 650 tonnes of 
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steam are discharged. There is no main steam isolation valve. As a matter of fact, such valves are 
never considered in the design, partly because the normal operating iodine 131 activity level is 
deliberately kept low at 3.7 x 10? Bq/L (107 Ci/L) by prompt detection and removal of defective fuel 
(the regulatory limit is 3.7 x 105 Bq/L (10° Ci/L)). 


III.12.2. Findings 

1. Radioactive releases from ruptured steam pipes are an unmonitored and uncontrolled release 
of radioactive material and is therefore undesirable. While the normal operating I-131 level 
is low, the level could increase by as much as ten fold during the accident, resulting perhaps 
in a not insignificant release of radioactive material. 

2. It is difficult to believe that the integrity of the leaktight room can be maintained if the main 
steam pipe ruptures inside it. The consequence of structural failure of leaktight rooms should 
be investigated. 

III.12.3. Plant specific status 
Not applicable. 

III.12.4. Recommendation 

1. Іп order to minimize the unmonitored release of radioactive materials to the extent practical, 


it is recommended that the installation of main steam isolation valves be considered. Due 
consideration should be given to the safety advantages and disadvantages of such valves. 


11.13. SITE BLACKOUT 
П1.13.1. Summary of discussion 

Following a site blackout, control rods drop into core under their own weight, shutting down 
the reactor. The pressure increases in the steam separator and this pressure increase is maximized by 
assuming that one steam safety valves and all dump valves to condenser fail to open. The PHOENIX 
code is used to analyse the transient. Pressure in the steam separator increases to 78 bar. Main 
cooling pumps rundown provide some circulation and cooling and natural circulation is effective up 
to 40% full power. In 42 seconds, ECCS flow is established. Adequate fuel cooling is maintained 
throughout the transient and there are no predicted fuel cladding failures. Cold shutdown with a 
coolant temperature of 20°C is considered as the final stable state. 
III.13.2. Finding 


1. The calculated thermal hydraulic behaviour of the primary coolant system during a blackout 
accident is mild owing to effective natural circulation in the complex RBMK hydraulic circuit. 


III.13.3. Plant specific status 
Not applicable. 
IH.13.4. Recommendation 


1. Experimental and perhaps commissioning evidence is needed to substantiate the claimed 
effectiveness of the natural circulation mode of cooling. 
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Appendix IV 
ELECTRIC POWER SUPPLY 


IV.1. ELECTRIC POWER REQUIREMENTS 
Scope of review: Electric power requirements. 


Document/section reviewed: [14] (see Figs 20 and 21) 


IV.1.1. Summary of discussions 


The principles of main and standby grid connections of the RBMKs were discussed. There 
are differences between the three generations of RBMKs. The main difference between Ist and 2nd 
generation is the absence of generator circuit breakers in the connection between generators and main 
transformers in RBMKs of the Ist generation. At the Leningrad 1 and 2 power plants, a circuit 
breaker for each generator has already been installed in the course of a backfitting programme. It was 
stated that similar backfits will be performed on the remaining RBMKs of the Ist generation. The 
working group supports this plan as it offers an opportunity to supply the in house loads during all 
operational modes (standby, maintenance, starting up and shutting down phases). In the design of 
the 2nd and 3rd generation of RBMKs the two generators are connected via one three winding main 
transformer with the main grid. 


The standby power supply design was also discussed. In general there are two standby 
transformers devoted to two units. Each one of the standby transformers is capable of feeding any 
of the units by means of a common 6 kV double standby bus. 


The main and the standby grid connections at a specific site are tied into one common high 
voltage switchyard but to sections of different voltages. One concern for the Kursk plant is the fact 
that one single failure of a high voltage circuit breaker can lead to the loss of one generator and its 
main grid connection at Unit 2 and one standby transformer of Units 3 and 4. 


A lengthy discussion occurred on a major event like the loss of the grid with all units 
operating and subsequent station rejection and the attempt to maintain in-house power supply for all 
units by maintaining a stable operation of at least one turbine generator. 


The experts discussed the event of the recent fire in Chernobyl 2 and support the intention of 
RBMK operators and designers to pay very close attention to the operation of the disconnectors and 
further improvements of the circuit breaker reliability to avoid spurious reconnection of the main 
generator to the grid. 


Under degraded grid frequency conditions (< 48.4 Hz) the operator manually reduces reactor 
power, disconnects both generators from the grid and maintains in-house load. 


Relating to transfer from unit transformers to standby transformers in the shutdown from high 
power, the RBMK designers studied the behaviour of rotating devices as a mini grid of ‘generators’ 
and ‘loads’ (pump motors) during the period of lack of electrical supply. This concept considers 
essential pumps as loads fed from other equipment running down. This helps to maintain critical 
flows as high as possible until the equipment is returned to full electrical supply and capacity. 
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FIG. 21. Main interconnection scheme of Smolensk NPP. 
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TABLE XVII. ELECTRIC POWER SUPPLY MODIFICATIONS LIST 
1500 


13 


14 


2nd gen. 3rd gen. 


Installation of a circuit breaker partially not not planned 
between the generator and the performed required required (Unit. 1) 
main transformer 

Construction of a building for planned not not not 
rehable power supply to safety required required required 
systems 

Construction. of diesel generator planned not not not 
plant for safety systems required required required 
Improvement of protective devices partially planned not not 

for generators and main performed required required 
transformers 

Replacement of generator partially not not not 
excitation. systems performed required required required 
Substitution of leaktıght storage planned not not 
batteries. for open ones required required 
Substitution. of water for gas for planned not not not 

fire extinguishing in cable rooms required required required 
Cable coating with fire retardant performed performed performed performed 
compounds 

Review of the current condition partially not not 

and physical separation of cables performed required required 


running in the same room 


Partial grounding of 6 kV network performed 


neutral 


performed 


Testing of diesel generators in planned planned performed 
parallel with the gnd during the 

unit operation 

Improvements ın reliability of planned planned planned 


control circuits for high voltage 
breakers 


Remote control of disconnectors in planned planned 
the generator circuit from the Unit 


control room 


partially 
performed 


Redundancy for the automatic petformed 
devices of the grid, involved in 


disconnection of generators from 


performed 


the grid (System control by 
generation shedding and load 
reyection ) 


Site 


Done at Leningrad 1 
Planned for Unit 2 
reconstruction 


Done at Leningrad 1 
Planned for 
Leningrad 2 
reconstruction 


Done at Leningrad 1 
Planned for 
Leningrad 2 
reconstruction 


Done at Kursk 3,4 
and Smolensk 1,2 By 
the end of 1992 for 
the others 


Following Chernobyl 2 
fire 


Following Chernobyl 2 
fire 
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IV.1.2. 


IV.1.3. 


IV.2, 


Findings 


The first generation of RBMKs is not equipped with generator circuit breakers, but as part of 
a backfitting program, such breakers have meanwhile been implemented at Leningrad 1 and 
2. Within the subsequent generations of RBMKs, however, these generator circuit breakers 
are already installed. 


The experts discussed the event of the fire in Chernobyl 2 in October 1991 and were informed 
that the current design is being modified to remotely control the disconnector in the high 
voltage switchyard from the unit control room. The operating procedure should also require 
immediate confirmation of the disconnect opening. 


АП RBMKs are connected to the main grid via main transformers and standby transformers. 
Examination of the circuit diagram for the Kursk plant revealed a specific situation in which 
a single failure of one high voltage circuit breaker can lead to the loss of one turbine generator 
and its main grid connection at Unit 2 and one standby transformer of Units 3 and 4 at the 
same time (this, however, does not fail a safety function). 


As a consequence of the Chernobyl 4 accident, the automatic supply of the in-house loads 
from the main generator isolated from the main grid upon loss of voltage from the grid is now 
prevented by protective features. The diesel generators maintain power supply to essential 
loads over an extended period of time until power supply from the grid can be restored. 


Under degraded frequency conditions however, the operator manually reduces reactor power, 
disconnects both generators from the grid and maintains in-house load by continuing to operate 
one of the two generators. Transfer from the unit transformer to a standby transformer is 


always a ‘slow’ transfer (~0.5 s) and special relaying is used to allow critical pumps to 
continue operation during the transfer. 


Plant specific status 


See Table XVII. 


Recommendation 
An optimization investigation shall be carried out to avoid frequent diesel startup caused by 


transient voltage fluctuations of the grid. This recommendation falls under the second level 
of priority. 


EMERGENCY POWER SUPPLY SYSTEM 


Document/section reviewed: (15) (see Figs 22-24) 


IV.2.1. 


Summary of discussions 


The general arrangement of safety and safety related channels was explained in detail for the 


3rd generation of RBMKs. Three electrically, physically and mechanically separated trains are 
provided by the design for the safety systems. Each train has 50% of capacity. Additionally there 
are two safety related channels with 100% capacity each. The two safety related channels are 
independent from each other. There are a total of 5 diesel generators installed in the 3rd generation 
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FIG. 22. Scheme of auxiliary power of Leningrad 1 (RBMK Ist generation). 
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FIG. 23. Scheme of auxiliary power of Smolensk 1 (КВМК 2nd generation). 
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FIG. 24. Scheme of auxiliary power of Smolensk 3 (RBMK 3rd generation). 


of RBMKs, three of them are devoted to safety and two of them to the safety related channels. Within 
the Ist and 2nd generation of RBMKs three diesel generators serve safety and safety related functions 
at the same time. The philosophy of the design seems to meet the single failure criterion. 


Information was provided that strict train separation within the cabling system could not be 
maintained throughout the plant. Where separation could not be maintained, special features have 
been used, especially for protection against fire. Further clarification of this aspect will only be 
possible during site specific inspection. 


Due to the procedure of transfer from the unit service transformer to the standby transformer, 
bus voltage drops for a short duration to the region of 50-25% of the nominal voltage. The diesel 
generator starts when voltage on the safety bus has decreased down to 25%. It was of concern that 
there is a possibility (although of low probability) of low bus voltages, but above the diesel generator 
testing value (see also Section IV.3.2). 


The fire retardant cable coating and its ageing, degradation and environmental qualification 
were discussed and here also the experts have a concern that requires field investigation. 


A brief account of the Ignalina systems in this area showed that it is much advanced with 6 
diesel generators which can supply the emergency loads in about 35 seconds (ECCS pumps after 20 
sec). These are in 6 separate channels with their auxiliaries and loads, and to fulfil all emergency 
requirements, 4 are needed out of 6. 
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IV.2.2. 


IV.2.3. 


IV.3. 


Findings 


Information was provided that strict train segregation within the cabling system could not be 
maintained throughout the plant. Where separation could not be maintained, special features 
have been used, especially for protection against fire. Further clarification of this aspect will 
only be possible during site specific inspection. 


А backfitting program is planned for the first generation of RBMKs. A new building 
containing three new diesel generators and their associated support systems to supply the 


safety buses will be built. The existing three diesel generators are intended to supply normal 
and safety related systems only. 


Plant specific status 


See Table XVII. 


Recommendations 


Redundant channel separation and protection against common mode failures should be further 
analysed on a site by site basis; the commencement of this analysis should also be given high 
priority. 


Further investigation concerning qualification of electrical equipment under harsh 
environmental conditions should be performed. 


DIESEL GENERATORS 


Document/section reviewed: [16] 


IV.3.1. 


Summary of discussions 


The diesel generators in the emergency power supply system in the second and third 


generation were discussed. The general conclusion from the review is that these units meet the usual 
requirements in the experience of the experts with some exceptions already identified in this report 
and in the course of the discussion. One concern is the idling of diesel generators during monthly 
testing and there were some questions about raising reliability through redundancy of some elements. 


IV.3.2. 


1. 


Findings 


An automatic startup signal for the diesel generator will be initiated on a vital bus voltage 
level of 25%. 


The startup and loading of the safety diesel generators is completed in approximately 50 5, 
whereas the ECCS pumps are put in operation after 20 s following the ultimate DBA. 
Information was provided that the discharge time of the ECCS water accumulators is of the 
order of 60 to 90 s. The experts have a concern with the tight margin between accumulator 
discharge and water availability from the diesel generator fed ECCS pumps. 


А backfitting programme is planned for the 1st generation RBMKs: a new building, containing 
three new diesel generators and their associated support systems to supply the safety buses, 
will be built. The existing three diesel generators are intended to supply normal and safety 
related systems only. 
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IV.3.3. Plant specific status 


See Table XVII. 


IV.3.4. Recommendations 


1. The undervoltage criterion for automatic diesel generator startup should be raised up to about 
80% of the nominal voltage. 


2. The backfitting programmes for the RBMKs of the Ist generation should be implemented. 


IV.4. DIRECT CURRENT SYSTEM 
Document/section reviewed: [17] (see Figs 25-27) 
IV.4.1. Summary of discussions 
The DC circuits of the second and third generation RBMK, together with invertor generated 
AC, appears to meet all normal requirements. As long as the physical realization is as described, the 


needs of the reactor units would be met satisfactorily. 


There are minor differences between the second and third generation plants. 
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power supply 
system 
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| 
| 
| 


Unit 1 


FIG. 25. Scheme of the reliable power supply train of Leningrad 1 (RBMK Ist generation). 
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FIG. 26. Scheme of the reliable power supply train of Smolensk 1 (RBMK 2nd generation). 
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FIG. 27. Scheme of the reliable power supply train of Smolensk 3 (RBMK 3rd generation). 
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In the first generation RBMK, the DC supply is from a single battery and from a single 
sectionalized bus. This sectionalized bus supplies all three safety channels. A single failure can 
disable all safety circuits. In this case there is a possibility to recover DC supply by manual 
connection of batteries of the other unit. This will, however, take certain time. A change should be 
planned on high priority to install three DC buses and three batteries. These could be supplied from 
the three existing alternating current buses. The change should be co-ordinated with the larger backfit 
plan for new diesel generators and power circuits. 


During the discussions of the DC systems, the experts were informed about the designed 
battery discharge time, which presently is 30 minutes for all the three generations of RBMKs. In the 
past, this was also the case in plants in western countries. Meanwhile, it became a standard approach 
to raise the extended battery discharge time to the order of 1 hour or more to be able to cope with 
station blackout and accident management requirements. 


The experience reported on the performance of reversible motor generators did not indicate 
specific problems. 


Additionally, concern was raised about the use of battery cell selector switches in the 1st 
generation to maintain the DC bus voltage within specified limits. The reliability of operation under 
accident conditions is the main concern as this device has to perform active actions. 


ГУ.4.2. Findings 


1. In the first generation of RBMK plants the DC supply is from a single battery and one single 
sectionalized bus, feeding three safety channels. One single failure can disable all safety 
circuits. DC power can only be recovered after a certain time by manual connection to the 
battery of the other unit. 


2. Battery cell selector switches are used within the 1st generation plants to maintain the DC 
voltage within the specified range. 


3. The designed battery discharge time is presently 30 minutes, for all the three generations of 
RBMKs. 


IV.4.3. Plant specific status 
See Table XVII. 
IV.4.4. Recommendations 


1. А change for the first generation of RBMK plants should be planned with a high priority to 
increase the degree of redundancy of DC buses and batteries. The degree of redundancy of 
the DC system should be in accordance with the existing 3 channels of the 6 Kv safety supply 
system. These could be electrically supplied from the three existing alternating current buses. 
This change could probably be co-ordinated with the large backfit plan for new diesel 
generators and power circuits, when it is put into effect. 


2. When relocating the above mentioned batteries into the new “етегрепсу power supply 
building’, no battery cell selector switches shall be used for reliability reasons. Train 
separation shall be maintained from the new equipment in this building down to the safety 
equipment inside the existing plant. 


3. The designed battery discharge time for all RBMK generations currently is 30 minutes. The 
experts therefore recommend the implementation of batteries of higher capacities in the order 
of 1 to 2 hours, based on an analysis of system behaviour under station blackout conditions. 
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FIG. 26. Scheme of the reliable power supply train of Smolensk 1 (RBMK 2nd generation). 
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FIG. 27. Scheme of the reliable power supply train of Smolensk 3 (RBMK 3rd generation). 
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In the first generation RBMK, the DC supply is from a single battery and from a single 
sectionalized bus. This sectionalized bus supplies all three safety channels. A single failure can 
disable all safety circuits. In this case there is a possibility to recover DC supply by manual 
connection of batteries of the other unit. This will, however, take certain time. A change should be 
planned on high priority to install three DC buses and three batteries. These could be supplied from 
the three existing alternating current buses. The change should be co-ordinated with the larger backfit 
plan for new diesel generators and power circuits. 


During the discussions of the DC systems, the experts were informed about the designed 
battery discharge time, which presently is 30 minutes for all the three generations of RBMKs. In the 
past, this was also the case in plants in western countries. Meanwhile, it became a standard approach 
to raise the extended battery discharge time to the order of 1 hour or more to be able to cope with 
station blackout and accident management requirements. 


The experience reported on the performance of reversible motor generators did not indicate 
specific problems. 


Additionally, concern was raised about the use of battery cell selector switches in the 1st 
generation to maintain the DC bus voltage within specified limits. The reliability of operation under 
accident conditions is the main concern as this device has to perform active actions. 


ГУ.4.2. Findings 


1. In the first generation of RBMK plants the DC supply is from a single battery and one single 
sectionalized bus, feeding three safety channels. One single failure can disable all safety 
circuits. DC power can only be recovered after a certain time by manual connection to the 
battery of the other unit. 


2. Battery cell selector switches are used within the 1st generation plants to maintain the DC 
voltage within the specified range. 


3. The designed battery discharge time is presently 30 minutes, for all the three generations of 
RBMKs. 


IV.4.3. Plant specific status 
See Table XVII. 
IV.4.4. Recommendations 


1. А change for the first generation of RBMK plants should be planned with a high priority to 
increase the degree of redundancy of DC buses and batteries. The degree of redundancy of 
the DC system should be in accordance with the existing 3 channels of the 6 Kv safety supply 
system. These could be electrically supplied from the three existing alternating current buses. 
This change could probably be co-ordinated with the large backfit plan for new diesel 
generators and power circuits, when it is put into effect. 


2. When relocating the above mentioned batteries into the new “етегрепсу power supply 
building’, no battery cell selector switches shall be used for reliability reasons. Train 
separation shall be maintained from the new equipment in this building down to the safety 
equipment inside the existing plant. 


3. The designed battery discharge time for all RBMK generations currently is 30 minutes. The 
experts therefore recommend the implementation of batteries of higher capacities in the order 
of 1 to 2 hours, based on an analysis of system behaviour under station blackout conditions. 


114 


REFERENCES 


In order to facilitate the review, supporting documentation was prepared by RBMK specialists 


in English under the co-ordination of RDIPE, Moscow. These documents were not published in the 
open literature. The areas covered by this documentation are given below. 


[1] 


[2] 


[3] 
[4] 
[5] 
[6] 
[7] 
[8] 


[9] 


[10] 
[11] 
[12] 
[13] 


[14] 


[15] 
[16] 


[17] 


BORSHCHEV, V.P., PODLAZOV, L.N., Core Design Part 1 Neutron and Physical Design 
and Operational Calculation, RDIPE, Moscow (1992). 


POSTNIKOV, V.V, PODLAZOV, L.N., Core Design Part 2, Monitoring and On-line 
Operation Estimation of RBMK Core, RDIPE, Moscow (1992). 


UKHAROV, S.G., PODLAZOV, L.N., Shutdown System, RDIPE, Moscow (1992). 
IONOV, A.I., PODLAZOV, L.N., Reactivity Accidents, RDIPE, Moscow (1992). 
PODLAZOV, L.N., Safety Concerns, RDIPE, Moscow (1992). 

BALDIN, V.D., POTAPOV, A.A., Pressure Tube Design, RDIPE, Moscow (1992). 
POTAPOV, A.A., Reactor Coolant System Design RDIPE, Moscow (1992). 


POTAPOV, A.A., STRELKOV, B.P., Reactor Coolant System Inspection, RDIPE, Moscow 
(1992). 


KISELEV, V.A., STRELKOV, B.P., POTAPOV, A.A., Leak Before Break Concept, 
RDIPE, Moscow (1992). 


NIKITIN, Yu.M., Emergency Core Cooling System DBA Part 1, RDIPE, Moscow (1992). 
NIKITIN, Yu.M., Emergency Core Cooling System DBA Part 2, RDIPE, Moscow (1992). 
NIKITIN, Yu.M., Emergency Core Cooling System Beyond DBA, RDIPE, Moscow (1992). 
NIKITIN, Yu.M., Confinement System, RDIPE, Moscow (1992). 


BARINOV, V.M., MANEVICH, Ya.B., Electric Power Requirements, MOAEP, Moscow 
and additional electric schemes (appendices) (1992). 


BARINOV, V.M., Auxiliary Generation System, MOAEP, Moscow (1992). 
BARINOV, V.M., Emergency Power Supply, Diesel-Generator, MOAEP, Moscow (1992). 


BARINOV, V.M., Direct Current System, MOAEP, Moscow (1992). 


115 


LIST OF ABBREVIATIONS 


AA absorber assemblies 

AC alternating current 

ALS accident localization system 

AR automatic control rods for controlling power 

ASS additional scram system 

ASSET Assessment of Safety Significant Events Teams 
BDBA beyond design basis accident 

BWR boiling water reactor 

CANDU pressurized heavy water moderated and cooled pressure tube type reactor 
COD crack opening displacement 

CPS control and protection system 

CR control rods 

DBA design basis accident 

DC direct current 

DCS cooling system for damaged parts of the reactor 
DEGB double ended guillotine break 

DG diesel generator 

DGH distribution group header 

DHC delayed hydrogen cracking 

ECCS emergency core cooling system 

EFP emergency feedwater pumps 

FA fuel assemblies 

fax radial power distribution coefficient 

fr axial power distribution coefficient 

FSS fast scram system 

I&C instrumentation and control 

IE initiating event 

Jr fracture resistance curve 

LAR automatic control rods for controlling local power 
LBB leak before break 

LSS level scram system 

LOCA loss of coolant accident 

MCP main circulation pump 

MCR manual control rods 

NDE non-destructive evaluation 

OPB-88 Soviet safety standard issued in 1988 

ORM operating reactivity margin 

PSA probabilistic safety analysis/assessment 

PSS power scram system 

PWR pressurized water reactor 

RBMK boiling water cooled graphite moderated pressure tube type reactor 
RDIPE Research and Development Institute of Power Engineering 
SBR short control rods inserted from the bottom of the reactor 
SD steam separator 

SI safety injection system 

SKALA computerized control and monitoring system 
55-(Мо) respective scram system 

TITAN computerized control and monitoring system 
UDBA ultimate design basis accident 

USNRC United States Nuclear Regulatory Commission 
VNIIAES All Union Scientific Research Institute for Nuclear Power Plant Operation 
UCS cooling system for undamaged parts of the reactor 
Ak reactivity worth 

f reactivity equivalent to the delayed neutron fraction 


117 


Adamchik, S. 
Adamov, E.O. 


Alomar Cremades, F. 


Almeida, C. 
Austman, H.L. 
Barinov, V.M. 
Bava, G. 
Brown, R.A. 
Burlakov, E. 
Bystedt, P. 


Chakraborty, S. 
Cherkashov, Yu.M. 


Czibolya, L. 
Gachot, B. 
Galati, A. 
Galberg, V.P. 
Guppy, J. 
Havel, R. 
Hayns, M.R. 
Hillairet, J. 
Höhn, J. 
Kalfsbeek, H. 
Karger, J.P. 
Kasai, Y. 
Knoglinger, E. 
Krayushkin, A. 
Langman, V.J. 
Lederman, L. 
Lenain, R. 
Lipinski, W. 
Lipunov, G.N. 


Martínez-Ofia, R. 
Melnikova, L.M. 


Michel, W 
Moffitt, R.L. 
Niehaus, R. 
Nikitin, Yu.M. 
Okamura, A. 
Podlazov, L.N. 
Potapov, A.A. 
Shevaldin, V. 
Simonen, F. 
Sorokin, N.M. 
Spencer, B. 
Tapia, J. 
Tkachev, V. 
Tolstykh, V. 
Tomic, B. 
Tong, J. 
Vasilyev, A.I. 
Wall, D.N. 
Watt, E. 


CONTRIBUTORS TO DRAFTING AND REVIEW 


GAN, Russia 

RDIPE, Russia 

INYPSA, Spain 

International Atomic Energy Agency 

Atomic Energy of Canada Limited, Canada 

MOAEP (Design Institute), Russia 

ENEA/DISP, ANT-FIS, Italy 

Atomic Energy of Canada Limited, Canada 

RRC Kuchatov, Russia 

Swedish Nuclear Power Inspectorate, Sweden 

Swiss Federal Nuclear Safety Inspectorate, Switzerland 
RDIPE, Russia 

International Atomic Energy Agency 

International Atomic Energy Agency 

ENEA, Italy 

Kursk NPP, Russia 

Brookhaven National Laboratory, United States of America 
International Atomic Energy Agency 

AEA Technology, United Kingdom 

EDF / Centre d’Ingenierie Generale, France 
International Atomic Energy Agency 

Commission of the European Communities 

Atomic Energy of Canada Limited, Canada 

PNC, Japan 

Paul Scherrer Institute, Switzerland 

RRC Kurchatov, Russia 

Atomic Energy of Canada Limited, Canada 
International Atomic Energy Agency 

C.E.A. - DRN/DMT/SERMA, France 

Argonne National Laboratory, United States of America 
State Nuclear Power Safety Inspectorate, Lithuania 
TECNATOM S.A., Spain 

RDIPE, Russia 

Siemens AG, Germany 

Battelle Pacific Northwest Laboratory, United States of America 
International Atomic Energy Agency 

RDIPE, Russia 

EPDC, Japan 

RDIPE, Russia 

RDIPE, Russia 

Ignalina NPP, Lithuania 

Battelle Pacific Northwest Laboratory, United States of America 
Chernobyl AES, Ukraine 

Argonne National Laboratory, United States of America 
Empresarios Agrupados SA, Spain 

RRC Kurchatov, Russia 

International Atomic Energy Agency 

International Atomic Energy Agency 

Atomic Energy Control Board, Canada 
Rosenergoatom, Russia 

AEA Technology, United Kingdom 

Scottish Nuclear Limited, United Kingdom 


119 


Weber, J.P. 
Zinger, V. 


120 


Gesellschaft für Reaktorsicherheit (GRS) mbH, Germany 
International Atomic Energy Agency 


Consultants Meeting 


Vienna, Austria: 27 October - 5 November 1992 


92-05391 


